Merge `starbase/main` into `main` and sync Starbase-managed updates. [CRAFT-5264](https://warthogs.atlassian.net/browse/CRAFT-5264) ## Overview of Starbase changes pulled in - Build tooling: shfmt and tombi formatters, docs-clean in the clean target, ruff 0.16, pre-commit hook updates. - CI: zizmor findings resolved across workflows, expanded policy job permissions, release workflow fix, renovate workflow improvements. - actionlint: allow the `spread-enabled` self-hosted runner label. - Docs tooling: Sphinx Stack conventions (sphinx-llm, sphinx-rerediraffe, slug declaration, `docs/_dev` replacing `docs/.sphinx`), updated docs dependency pins. - AGENTS.md scaffolding: repo-specific `AGENTS.md` derived from the `AGENTS.lib.md` template (library repo); both template files deleted. ## Conflict resolution See the merge commit message for full details. Highlights: - Child kept: `.github/CODEOWNERS`, `.github/workflows/qa.yaml`, `CONTRIBUTING.md`, `Makefile` lint targets (this repo uses `ty`, not mypy/pyright), `[project]`, `[dependency-groups]`, `[build-system]` in `pyproject.toml`. - Starbase taken: `common.mk`, policy/renovate/release/tics workflows (TICS project set to `craft-parts`), `.gitignore`, `.pre-commit-config.yaml`, `.readthedocs.yaml`, `docs/Makefile`, `docs/requirements.txt`, `tool.ruff`, `docs-sphinx-stack` dependency group. - `uv.lock` regenerated locally from the merged dependencies. - All follow-up fixes (OSV scan exclusion in `policy.yaml`, preserving `.gitignore` patterns, ruff hook pin restoration, wordlist cleanup with scoped Vale ignores, copyright year correction to 2021) folded cleanly into the single merge commit. ## Validation - `make format` ✅ - `make lint` ✅ - `make docs` ✅ - `make test-fast` ✅ (15 failures in java/maven/ant plugin tests are environmental — no Java toolchain in this environment — and fail identically on `main`) [CRAFT-5264]: https://warthogs.atlassian.net/browse/CRAFT-5264?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ ## Preparation PRs The following fixes were surfaced by this merge, split into preparation PRs, and merged into `main`: - #1732 — test: bump black fixture to 26.3.1 (merged) - #1733 — build: raise setuptools floor to 77.0 (merged) - #1734 — docs: ignore debian.org in linkcheck (merged) ## Notes - `Security scan / OSV-scanner` fails on new urllib3 advisories that also affect `main`. Fixed by preparation PR #1753 (draft). - QA currently fails with `startup_failure` due to an upstream starflow regression (canonical/starflow#185 filed); unrelated to this PR's content.