Bumps the actions group with 4 updates: [hynek/build-and-inspect-python-package](https://github.com/hynek/build-and-inspect-python-package), [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish), [j178/prek-action](https://github.com/j178/prek-action) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `hynek/build-and-inspect-python-package` from 2.18.0 to 3.0.1
- [Release notes](https://github.com/hynek/build-and-inspect-python-package/releases)
- [Changelog](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md)
- [Commits](hynek/build-and-inspect-python-package@d44ca7d...2abe76d)

Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@ba38be9...dc37677)

Updates `j178/prek-action` from 2.0.6 to 3.0.0
- [Release notes](https://github.com/j178/prek-action/releases)
- [Commits](j178/prek-action@5337cb9...4e14d07)

Updates `zizmorcore/zizmor-action` from 0.6.1 to 0.6.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@6fc4b00...3dc1ecc)

---
updated-dependencies:
- dependency-name: hynek/build-and-inspect-python-package
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: j178/prek-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Update dependencies

Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>

* [pre-commit.ci] pre-commit autoupdate

updates:
- [github.com/astral-sh/ruff-pre-commit: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56 → 39d9ac5938dadb73df0564a45f163e25ff9fa6e2](astral-sh/ruff-pre-commit@c59bba8...39d9ac5)
- [github.com/pre-commit/mirrors-mypy: d2823d321df3af8f878f7ee3414dc94d037145b9 → 41e691678310dfd3833f7ab4e180ddb014310356](pre-commit/mirrors-mypy@d2823d3...41e6916)
- [github.com/codespell-project/codespell: 2ccb47ff45ad361a21071a7eedda4c37e6ae8c5a → 57b21406f092110c18776e39b0bda50d37c945c8](codespell-project/codespell@2ccb47f...57b2140)

* chore: fix lint errors from new ruff rules

Ruff 0.16 enables BLE, TRY, and N999 by default. Use local noqa
excludes for the blind-except catches, ignore TRY002 and N999 in tests,
and drop the pylint equivalents.

Assisted-by: ClaudeCode:claude-opus-5

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Henry Schreiner <henryfs@princeton.edu>

* chore: faster mypy

This makes mypy around 26% faster from a cold cache.

Signed-off-by: Henry Schreiner <henryfs@princeton.edu>

* chore: enable more mypy error codes

Turn on possibly-undefined, exhaustive-match, and other strict flags, and
fix what they report. Two real bugs: pyodide never set `repaired_wheel`
when it reused a compatible wheel, so the test step failed with a
NameError; the OCI shell read loop spun forever if the shell exited.

Assisted-by: ClaudeCode:claude-opus-5

* test: carry default OCI runtime into podman vfs test config

Podman ignores its usual config files when CONTAINERS_CONF is set, so it
falls back to the first runtime found on PATH. On current GitHub Ubuntu
runner images that is crun 1.14.1, which cannot parse the OCI spec v1.2.x
config that podman 5.8.4 generates ("crun: unknown version specified").
Query the default runtime path and set it in the generated config.

Assisted-by: ClaudeCode:claude-fable-5

* fix: annotate vfs config dict so mypy passes on Linux

mypy on macOS marks the rest of the function unreachable after the
darwin pytest.skip, so the strict index error only appears on Linux.

Assisted-by: ClaudeCode:claude-fable-5

* chore: minor cleanup of variable name

Signed-off-by: Henry Schreiner <henryfs@princeton.edu>

* test: cover container shell exiting during call

Assisted-by: ClaudeCode:claude-opus-5

---------

Signed-off-by: Henry Schreiner <henryfs@princeton.edu>

Update dependencies

Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>

… in the actions group (#2969)

* chore(deps): bump actions/attest-build-provenance in the actions group

Bumps the actions group with 1 update: [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance).


Updates `actions/attest-build-provenance` from 4.1.1 to 4.2.2
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](actions/attest-build-provenance@0f67c3f...4d10147)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>

* Apply suggestion from @henryiii

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Henry Schreiner <HenrySchreinerIII@gmail.com>

…ons group (#2974)

chore(deps): bump astral-sh/setup-uv in the actions group

Bumps the actions group with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv).


Updates `astral-sh/setup-uv` from 9.0.0 to 10.0.1
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@c771a70...20cfd1b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Update dependencies

Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>

Update dependencies

Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>

* Update dependencies

* revert to `build==1.5.0` while waiting for `1.6.1`

---------

Co-authored-by: cibuildwheel-bot[bot] <83877280+cibuildwheel-bot[bot]@users.noreply.github.com>
Co-authored-by: mayeut <mayeut@users.noreply.github.com>

* fix: respect configured NuGet package sources

* test: use concise NuGet args name

---------

Co-authored-by: Shurong Cao <170531907+CAOShurong@users.noreply.github.com>
Co-authored-by: Matthieu Darbois <mayeut@users.noreply.github.com>