feat(core): merge pyproject.toml (and tooling manifests) across template layers

[ulises-jeremias]

Summary

When applying extension layers, merge pyproject.toml (and related tooling tables) instead of last-writer-wins copy overwrite.

Today #27 / loaders only do copy_tree. Extensions that need deps must either ship a full pyproject.toml or document manual reconcile — blocking realistic FastAPI/docker/postgres-style addons.

CNA mapping

CNA: package/index.js + package/dependencies.js / devDependencies.js merge into package.json.

CPA target: deep-merge TOML tables for:

• [project].dependencies / optional-dependencies
• [dependency-groups]
• [tool.ruff], [tool.pytest.ini_options], etc. (documented merge rules)

Acceptance criteria

• Later layers merge into an existing destination pyproject.toml rather than blindly replacing it
• Dependency lists are unioned (deduped); version conflicts have a defined policy (document + test)
• Non-pyproject.toml files keep current copy/overwrite (or .append once that lands)
• Extension can add a dependency without shipping a full project manifest
• Unit tests for: fresh file, merge deps, conflict policy, multi-layer stack
• Document merge rules in core docs and point cpa-templates AUTHORING at them

Related

• Supersedes incomplete AC from closed Template/extension loaders + merge model #27 (“Merge pyproject/tooling manifests appropriately for Python”)
• Complements Jinja .template / .append work (can land independently)

Blocked by

none (can ship before Jinja)

Blocks

Richer cpa-templates extensions that only declare deps/tooling overlays.

Reference

• Closed Template/extension loaders + merge model #27 / PR feat(core): template/extension loaders and merge model (#27) #85 (copy-only baseline)
• CNA package.ts / package/ system
• CPA: packages/create-python-app-core/src/create_python_app_core/loaders.py