[Dependency/Sync] Batch shared dev-tool pin updates through one source lane

[stranske]

Why

Shared developer-tool pins are currently checked and propagated by several scheduled surfaces: .github/workflows/maint-auto-update-pypi-versions.yml:11-15,45-141, .github/workflows/maint-50-tool-version-check.yml:6-9,43-149, Maint 52, and maint-sync-env-from-pyproject.yml. The repository documentation in docs/ci/TOOL_VERSION_MANAGEMENT.md still describes a partly manual Maint 50 flow even though a daily updater can open source PRs.

This is a current churn source: the same upstream version movement can be detected, commented on, proposed, and propagated by different workflows before the canonical source state settles. That creates extra source PRs, consumer waves, and agent decisions.

Scope

Choose one canonical source-update lane for Workflows-owned dev-tool pins, batch routine releases into a predictable window, and make Maint 52 propagation-only. Preserve immediate handling for explicitly security-sensitive updates.

Non-goals

• Do not allow consumer repos to own partial bumps of Workflows-managed pins.
• Do not weaken lockfile reproducibility or compatibility testing.
• Do not combine product/runtime dependency policy with the shared dev-tool policy.
• Do not count schedule edits or documentation-only scaffolding as delivery without a mismatch fixture that exercises the canonical-source and propagation contract.

Implementation tasks

• Define the canonical pin set and owner across .github/workflows/autofix-versions.env, pyproject.toml, consumer/integration template env files, and requirements.lock.
• Refactor .github/workflows/maint-auto-update-pypi-versions.yml into the sole source proposal lane with a weekly batch window and a documented security override.
• Remove duplicate upstream-version proposal/comment behavior from .github/workflows/maint-50-tool-version-check.yml; retain only a bounded policy/freshness audit if it adds unique evidence.
• Make .github/workflows/maint-52-sync-dev-versions.yml propagation-only: it must consume a settled canonical source commit and must not independently decide newer versions.
• Keep .github/workflows/maint-sync-env-from-pyproject.yml as a deterministic source-consistency check or replace it with a named equivalent; prevent it from racing the source proposal lane.
• Group routine ruff, black, mypy, pytest, pytest-cov, pytest-xdist, coverage, isort, and docformatter changes into one bounded source PR per window.
• Update docs/ci/TOOL_VERSION_MANAGEMENT.md, docs/ops/CONSUMER_REPO_MAINTENANCE.md, and contributor guidance with ownership, cadence, emergency handling, and supersession rules.
• Close or explicitly supersede overlapping dependency-bot PRs only after the canonical source proposal or merged source commit exists.

Acceptance criteria

• tests/workflows/test_maint52_sync_dev_versions_pr_body.py proves Maint 52 reports the canonical source commit and never proposes an upstream version independently.
• tests/workflows/test_sync_dev_dependencies.py proves env, pyproject, template, and lockfile pins move together for every managed tool.
• A new policy test proves one weekly source proposal can contain multiple routine tool updates and that a security fixture bypasses the window without bypassing tests.
• Maint 50 and the source updater cannot open or comment competing proposals for the same canonical delta.
• Consumer propagation starts only after canonical source validation succeeds and creates at most one current wave per repo.
• Deliberate-break test: introduce one mismatched managed-tool pin in a template or lockfile, verify the named consistency test fails with the exact path/tool, then revert and verify it passes.
• Run python scripts/dev_check.py --action test and the workflow-validation suite successfully.

Delivery notes

This issue should land after the ownership exclusions in #2876 so consumer Renovate cannot reintroduce partial shared-tool bumps while the source lane is being consolidated.

[stranske]

Closer sequencing — verifier CONCERNS (reopen)

PR #2902 merged at 2026-08-02T19:22:48Z and GitHub auto-closed this issue before the durable verify:compare report landed.

Provider Comparison Report on #2902 (comment at 2026-08-02T19:30:48Z) is CONCERNS (openai + anthropic agreed). Issue remains open until a bounded follow-up lands the residual acceptance gaps or a later durable PASS closes the chain.

Audited against current main (not treating the verdict as a rubber-stamp human blocker):

• Source lane / Maint 50 exclusivity / policy weekly+security window / Maint 52 canonical_source_sha recording are present (tests/workflows/test_dev_tool_source_lane.py, tests/scripts/test_dev_tool_update_policy.py, maint-52 prepare job).
• Residual closer-owned gaps: strengthen Maint 52 PR-body / no-independent-PyPI assertions; prove source-lane validation runs before Create PR (including security_override); make deliberate pin-mismatch coverage explicit for the AC path; address overlapping dependency-bot supersession after a canonical proposal exists.

Next: bounded follow-up PR from the closer lane.

[stranske]

Sequencing: keep open until durable verifier PASS

PR #2903 was squash-merged at 1e303fcedb6bd114cb2f5a791a1d2fa05d16d949 (2026-08-02T20:36:20Z) and labeled verify:compare. GitHub auto-closed this issue via Closes #2882; reopening so completion waits on a durable Provider Comparison / verifier PASS on #2903 (no remaining review/disposition debt). Will close again only after that PASS.

[stranske]

Verifier disposition — cumulative current-main PASS

Audited the verify:compare CONCERNS report on merged follow-up #2903 against the full source lineage and current main (1e303fcedb6bd114cb2f5a791a1d2fa05d16d949), rather than treating the follow-up diff in isolation.

• feat(maint): batch canonical dev-tool updates #2902 already delivers the cited Maint 50 / Maint 52 / documentation / consumer-template ownership changes.
• fix(maint): close #2882 verifier CONCERNS gaps #2903 delivers the residual validation-before-create, security-override, supersession, canonical-SHA, and explicit mismatch assertions.
• Current-main focused acceptance slice passes: 16 passed (Python 3.12); post-merge Gate and verifier checks are successful.

The compare concerns are therefore stale isolated-diff findings, not remaining acceptance debt. Closing #2882 as fully delivered by #2902 + #2903.