ci: drop macOS from the test matrices (#40)

Drop macOS from the CI test matrices (template ADR-0005).

macOS runners bill ~10x Linux and nothing in the portfolio runs on macOS
- the porting loop deploys to a read-only Linux container. Keep Ubuntu
(deploy parity) + Windows (dev platform).

- python-qa.yml: `full-os-matrix` "full" branch is now `[ubuntu-latest,
windows-latest]` (3 matrix jobs).
- template-ci.yml: tests matrix `[ubuntu-latest, windows-latest]`.
- docs/decision-records/template/0005-ci-excludes-macos.md
(living-schema ADR; check_adr_schema clean).

Follow-up: advance the floating v1 tag so consumers (engine-porter @v1)
inherit the matrix change.

chore: settle pt-m0 template cleanup

fix(docs): normalize NWarila owner casing across refs (#26)

## Summary
The repo lives at **`NWarila/`** (user account), but README badges,
`self-update.yml`, and the `reference/` configs referenced lowercase
**`nwarila/`**. GitHub redirects case-insensitively so most render, but
the **Codecov badge is case-sensitive** and showed no data on the
README. Normalized every owner reference to `NWarila/`:

- README badges (CI, Coverage, License, Platform) + architecture table +
usage examples
- `self-update.yml` release-lookup / clone URLs
- `reference/*` headers + `repo-ci.yml` `uses:` (these get copied into
downstream repos, so the slip was propagating)
- script header comments
- README intro: "the **nwarila** GitHub organization" → "the **NWarila**
GitHub account" (it's a user account, not an org)

Purely a casing normalization — no logic change. `.gitattributes` (`*
text=auto eol=lf`) handles line endings.

## Test plan
- [ ] Coverage badge renders (Codecov slug now matches `NWarila/`)
- [ ] CI green (no functional change)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: add real coverage measurement and direct-import tests (#6)

## Summary

The test suite was running scripts via subprocess, which meant
pytest-cov couldn't instrument them — **coverage was silently 0% while
the 90% threshold appeared to pass**. The quality gate this repo ships
to downstream repos was never enforced on itself.

- Make `scripts/` importable (add `__init__.py`, configure
`pythonpath=["."]`)
- Add `--cov=scripts --cov-report=term-missing` to `pyproject.toml`
addopts
- Add 79 direct-import tests across 3 new test files
- Allow `_find_project_root()` to accept an optional start path for
testability

## Coverage: 0% → 92%

| Script | Before | After |
|--------|--------|-------|
| check_lint.py | 0% | 98% |
| check_tests.py | 0% | 95% |
| check_types.py | 0% | 92% |
| check_package.py | 0% | 91% |
| qa.py | 0% | 91% |
| sync.py | 0% | 90% |
| check_spelling.py | 0% | 90% |
| check_security.py | 0% | 88% |
| **Total** | **0%** | **92%** |

## Test plan

- [x] 79 new direct-import tests all pass locally
- [x] Lint and format clean
- [x] Coverage threshold (90%) now actually enforced
- [x] Existing subprocess smoke tests preserved for CI integration
coverage

fix: resolve PROJECT_ROOT by walking up to pyproject.toml (#5)

## Summary

- Fix PROJECT_ROOT resolution in `qa.py`, `setup.sh`, and `setup.ps1` —
walk up to `pyproject.toml` instead of assuming `SCRIPT_DIR.parent`
- Add `TestProjectRootWalkUp` test class with 5 tests covering scripts/,
.github/scripts/, arbitrary depth, and missing pyproject.toml
- Document as resolved decisions 22 (pull-based sync) and 23
(PROJECT_ROOT bug) in PLAN.md

## Problem

Scripts assumed `PROJECT_ROOT = SCRIPT_DIR.parent` (one level up). When
running from `.github/scripts/` (two levels deep, the synced location in
downstream repos), the parent resolved to `.github/` instead of the repo
root. This broke tool discovery and `cwd` for every subprocess call.

## Fix

Walk up from the script's directory until `pyproject.toml` is found.
Applied consistently to `qa.py`, `setup.sh`, and `setup.ps1`. The
`PROJECT_ROOT` env var override is preserved as an escape hatch.

## Test plan

- [x] `test_qa_from_scripts_dir` — walk-up from scripts/ (one level)
- [x] `test_qa_from_github_scripts_dir` — walk-up from .github/scripts/
(two levels)
- [x] `test_qa_discovers_checks_from_github_scripts` — full orchestrator
with all checks skipped
- [x] `test_no_pyproject_toml_fails` — clear error message when
pyproject.toml is missing
- [x] `test_deeply_nested_scripts` — walk-up from a/b/c/scripts/ (four
levels)

refactor: replace push-based sync with pull-based reusable workflow (#4)

## Summary

- Remove `sync-downstream.yml` and its PAT requirement — sync is now
pull-based
- Downstream repos call `self-update.yml` as a reusable workflow via
`uses: nwarila/python-template/.github/workflows/self-update.yml@v1`
- Extract inline sync logic into `scripts/sync.py` (standalone,
stdlib-only, testable)
- Add `workflow_call` trigger so the same workflow serves both dogfood
and downstream
- Remove `downstream_repos` from `sync-manifest.json` (template doesn't
push)
- Document manifest-driven sync rationale vs submodules/packages

## Design

Each repo owns its own updates. The template publishes releases,
consumers pull when ready. No cross-repo credentials, no push
permissions, no coupling.

Downstream repos only need a thin wrapper:

```yaml
name: Template Sync
on:
  schedule:
    - cron: "0 6 * * 1"
  workflow_dispatch:
permissions:
  contents: write
  pull-requests: write
jobs:
  sync:
    uses: nwarila/python-template/.github/workflows/self-update.yml@v1
```

## Test plan

- [x] `scripts/sync.py` runs against this repo as template source (15
files synced)
- [x] Marker-preserve logic tested with template and repo-specific
regions
- [x] YAML syntax validated on self-update.yml
- [x] Manifest structure validated (no `downstream_repos`, all mappings
have src/dest)
- [x] All three workflow triggers present: `schedule`,
`workflow_dispatch`, `workflow_call`

fix: align downstream CI with released scripts path (#3)

## Summary

- make the reusable workflow execute released scripts from
.github/scripts/ in downstream repos
- sync template-managed scripts into downstream .github/scripts/ to
match that CI contract
- update reference tasks and docs so the downstream path contract is
consistent

## Why

The previous contract was internally contradictory: the reusable
workflow executed scripts/..., while the sync manifest and
released-script design expected CI/CD to consume .github/scripts/....

This change makes the repo follow the intended design that CI/CD should
use the released, known-good scripts path.

## Validation

- local ./.venv/Scripts/python.exe scripts/qa.py passed

chore: refresh action version pins (2026-04-08 audit) (#2)

## Summary

- Refresh third-party action SHA pins and version comments
- **Add self-dogfooding model**: template-ci.yml now runs quality gates
from `.github/scripts/` (released copies) instead of `scripts/`
(development source)

### Action pin updates
- `actions/setup-python`: version comment updated to v6.2.0 (same SHA)
- `actions/dependency-review-action`: version comment updated to v4.9.0
(same SHA)
- `astral-sh/setup-uv`: SHA updated from v7 to v8.0.0

### Dogfooding infrastructure
- **`.github/scripts/`**: Seeded from current `scripts/` — these are the
scripts template-ci.yml uses
- **`auto-release.yml`**: Auto-creates a patch release when `scripts/`
changes land on main
- **`self-update.yml`**: Nightly check downloads released scripts into
`.github/scripts/` and opens a PR
- **`template-ci.yml`** and **composite action**: Updated to reference
`.github/scripts/`
- **PLAN.md**: Documents the dogfooding architecture

### How the dogfood loop works
1. Developer changes `scripts/` → merges to main
2. `auto-release.yml` creates a new patch release
3. Nightly `self-update.yml` detects the release → downloads scripts to
`.github/scripts/` → opens PR
4. CI on that PR runs the NEW scripts against the repo
5. If green, merge updates the dogfood scripts

This ensures the template validates itself with the same artifacts it
ships to downstream repos.

## What remains blocked

- PR #1 requires human review to merge
- `dependency-review-action` Node.js 20 deprecation (no newer SHA
available)
- `sync-downstream.yml` UNVERIFIED-LIVE-RUN-REQUIRED