No dependency floor in pyproject.toml is tested

Inizia da pyproject.toml e dai workflow esistenti test.yml, docs.yml, build.yml e release.yml, quindi esamina come i vincoli di floors.txt interagiscono con le installazioni normali e isolate. Aggiungi un'esecuzione CI per Python 3.11 che verifichi le versioni minime dichiarate e aggiungi, dove appropriato, le assertion descritte sui metadati delle wheel; il lavoro è completato quando la suite passa con le versioni minime e le assertion distinguono tra le versioni di Hatchling supportate.

pyproject.toml declares eight >= floors. None of them is tested — every CI
leg installs the newest of everything, so each floor is a claim nobody has
checked.

requires-python = ">=3.11" is the exception, and is well covered: test.yml
runs a 3.11 leg on ubuntu and windows, [tool.mypy] python_version = "3.11"
type-checks against it, and CONTRIBUTING tells developers to develop on it. The
exact pins (mypy, ruff, build, twine) enforce themselves.

lxml>=5.0 is the one that matters to users: it is the only runtime dependency,
and the floor is a public compatibility promise. Nothing has ever installed
lxml 5.0 against this test suite.

Proposal

One CI leg on the Python floor that installs the declared minimums and runs the
suite:

  floors:
    runs-on: ubuntu-latest
    # python-version: "3.11"
    - run: python -m pip install -e .[dev] -c floors.txt
    - run: python -m pytest

floors.txt lists each declaration as == (lxml==5.0, pytest==8.0, …).
pip has no --resolution lowest — that is uv — so a constraints file is the
mechanism. The build-backend floor needs PIP_CONSTRAINT instead, since it is
resolved into build's isolated environment rather than the install
environment.

Expect this to fail at first and to move some floors up. That is the point: a
floor that fails is a floor that was wrong.

Related: the license-metadata assertion

Hatchling before 1.27 builds this project's wheel without complaint and emits
license = "MIT" as a legacy free-text field, dropping License-Expression and
License-File; twine check passes that wheel (see #24). A floor alone cannot
catch it, so build.yml and release.yml want a step asserting those two fields
are present in the built wheel — about nine lines of YAML each, verified to pass
a 1.32.0 wheel and fail a 1.26.3 one. It belongs with this work rather than
ahead of it: it would otherwise be the only enforced package floor in the file.