Update to Python 3

- Makefile with build/bump/release/verify targets using uv and macOS Keychain for token storage
- pyproject.toml: keywords, classifiers, Documentation URL, sdist include filter
- .gitignore: uv.lock, dist/, build/, *.egg-info/

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Promote ontology introspection out of the CLI layer into a storage-agnostic
diffbot.Ontology class so library consumers (e.g. langchain) can build valid
DQL on the fly, without depending on the disk-backed CLI cache.

- New diffbot/ontology.py: Ontology with types/composites/enums/taxonomies,
  fields_for, filter_fields, taxonomy_values, enum_values, find_named,
  format_field, plus from_json/from_path. Pure; imposes no caching policy.
- Client: dql_fetch_ontology() (sync + async) downloads and returns an
  Ontology; add async DiffbotAsync.dql_parallel() to mirror the sync one.
- cli/ontology.py now delegates to Ontology, keeping its ~/.diffbot disk cache
  and existing module API unchanged.
- tests/test_ontology.py covers the core, the HTTP fetch, and async parallel.

Also includes a pre-existing, in-progress credential-resolution refactor that
was already present in the working tree (diffbot/_auth.py and its consumers in
cli/_common.py, cli/dql.py, conftest, tests, README); __init__.py carries both
sets of changes, so they commit together.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

# Conflicts:
#	.gitignore
#	pyproject.toml

Run pytest on push/PR to main across Python 3.10-3.13 using the pinned
lockfile, plus a job that tests against the lowest allowed dependency
versions to catch range-compatibility breaks the lockfile would hide.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

0.2.0 shipped with a hardcoded __version__ = "0.1.0" that nothing kept in
sync with pyproject.toml. Read the version from importlib.metadata so the
package and module versions can never drift again.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

GitHub's Intel (macos-13) runners are being deprecated and their queue is
unreliable, which blocked the v0.2.2 release. Ship macOS as Apple Silicon
only; Linux keeps x86_64 + aarch64. Also add a concurrency group so
re-pushing a tag cancels an in-flight run, and a 30m build timeout so a
capacity-starved runner fails fast instead of hanging for 24h.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The release job downloads artifacts but never checks out the repo, so gh
could not infer the repository from a local git remote and failed with
"fatal: not a git repository". Pass --repo "$GITHUB_REPOSITORY" on every
gh release call.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The Diffbot LLM endpoint supports response_format, but the client had no way
to pass it: the payload in ask.py was hardcoded to model/messages/stream.

Adds response_format to ask() and a new ask_json() that returns a parsed
object, both sync and async, plus json_schema_format() to build the payload.
The CLI gains --schema, and --json now uses real structured output instead of
nudging the prompt and slicing between the first { and last }.

Server-side (see ../diffbot-llm) the schema is compiled to an EBNF grammar and
the final answer is constrained to it, so this is enforced decoding rather than
a request the model may ignore. Two rough edges are handled client-side:

- The schema must be nested at json_schema.schema. Anywhere else and the server
  returns 200 with the constraint silently dropped, so we reject that locally.
- The grammar permits a <think> block before the final answer, so ask_json
  strips think blocks and markdown fences before parsing.

ask_json without a schema deliberately sends a permissive {"type": "object"}
json_schema rather than {"type": "json_object"}. json_object gets no grammar
applied, and the RAG loop's internal tool call is itself a valid JSON object,
so it can be returned as the final answer -- reproducible with a system message
on some queries (5/5 on one, 0/12 without a system message). A guard raises
ValidationError if a tool call ever comes back.

Tested with 44 unit tests and 7 live tests against the real endpoint, covering
flat and nested schemas, streaming with a schema, async, and a regression test
for the system-message case.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

b64f6a1 regenerated the lock for the 3.9 floor before bumping the version in
pyproject.toml, so the lock kept recording 0.2.2. CI runs uv sync --frozen,
which skips the freshness check, so this never surfaced -- but it reappeared
as a dirty working tree after any uv command, and would fail uv lock --check.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>