fix(hygiene): detect unpinned dependencies with environment markers

[rioyu123]

Summary

• Detect unpinned dependencies even when a PEP 508 environment marker contains comparison operators, such as requests; python_version < "3.13".
• Inspect only the requirement portion before the marker when deciding whether a package has a version constraint.
• Preserve the existing policy that any requirement comparator counts as constrained; this does not redefine ?pinned? to require ==.
• Keep direct-reference behavior unchanged because direct-reference URLs may legally contain semicolons.
• Document the newly emitted warning in the Unreleased changelog.

Before this change, the validator searched the entire physical line for [=<>!], so marker operators could hide an unversioned package:

Requirement	Previous result	New result
requests; python_version < "3.13"	no warning	unpinned warning
requests; sys_platform == "win32"	no warning	unpinned warning
requests>=2; python_version < "3.13"	accepted	accepted
requests @ https://example.invalid/a;v=1/requests.whl	unchanged	unchanged

Known adjacent behavior remains out of scope: direct references keep their existing constraint policy, inline comments are not parsed, and backslash continuations are still evaluated as physical lines.

Verification

• I am familiar with the Contributing Guidelines
• Added or updated focused tests
• Updated documentation for user-visible changes
• Ran make lint
• Ran make test ? ran the complete affected validator domain instead
• Ran make build
• Did not add credentials, private datasets, or proprietary benchmark content

Results:

• uv run pytest -q tests/validators/test_hygiene.py ? 26 passed, 1 skipped
• uv run pytest -q tests/validators on Linux ? 847 passed
• make PYTHON=.venv/bin/python lint ? passed
• make PYTHON=.venv/bin/python build ? passed

Release Impact

• No user-visible release note needed
• Updated CHANGELOG.md

[rng1995]

One blocking marker-parsing case remains.

[rng1995]

Checking for @ anywhere in the full line misclassifies a marker value as a direct reference. For example, requests; implementation_name == "cpython@corp" produces no unpinned warning. Detect a direct-reference @ only in the requirement portion before ; (or parse the PEP 508 requirement), and add this regression.

[rioyu123]

Fixed in 5afe819. The direct-reference check now only considers @ before the environment marker, so requests; implementation_name == "cpython@corp" is still reported as unpinned. I added that regression, merged the latest upstream main without rewriting history, and resolved the CHANGELOG conflict. The focused hygiene tests pass (37 passed, 1 skipped), Ruff is clean, and the package build succeeds. The updated GitHub CI is now running.

[rng1995]

Thanks for handling the at-sign inside marker values. The direct-reference branch does not actually treat the at-sign as a constraint; it only scans the full URL for comparison characters. As a result, an ordinary requests direct reference to https://example.invalid/requests.whl is still reported as unpinned. The new direct-reference tests pass only because their URL or marker contains a comparison character. Please make the at-sign in requirement_part sufficient while keeping marker text excluded, and add a plain-URL regression.

[rioyu123]

Thanks — fixed in 29877b2. An @ in the pre-marker requirement now directly identifies a direct reference, while non-direct requirements only check comparison operators before the marker. I also added a plain-URL regression. The hygiene tests pass (38 passed, 1 skipped), and the full Ruff lint and build pass.