nss extras: strip git+https URLs to unblock PyPI uploads

The [nss] extra declared two direct git dependencies for the
handley-lab/blackjax fork and yallup/nss. PyPI and TestPyPI both reject
these in uploaded wheels with:

  400 Can't have direct dependency: blackjax @ git+https://...

Last successful PyAutoFit PyPI release was 2026.5.14.2 (May 14, 2026);
the [nss] extra was added on May 16 (commit 4d42e55), so every release
attempt since has been silently blocked at the twine upload step. This
surfaced today when a TestPyPI rehearsal failed the autofit upload while
the four downstream libraries (autoconf, autoarray, autogalaxy, autolens)
all uploaded fine.

The fix preserves the [nss] extra (still installs `fastprogress<1.1`)
and documents the manual `pip install git+...` step for the fork-based
deps directly in the pyproject.toml comment, so users running
`pip install autofit[nss]` see the next step at the source of truth.
SHAs are unchanged.

Wheel METADATA verified clean — no `git+` strings anywhere.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 2 people

pyproject.toml

@@ -76,23 +76,33 @@ optional = [
     "nautilus-sampler==1.0.5",
     "zeus-mcmc==2.5.4",
 ]
-# Phase 4 of nss_first_class_sampler — single safe install for `af.NSS`.
-# Pins the `handley-lab/blackjax` fork (BSD-3-Clause) which carries the
-# `blackjax.ns.adaptive.init` entrypoint that mainline blackjax lacks,
-# plus `yallup/nss` (BSD-3-Clause) on top. Both pinned to specific SHAs
-# so installs are reproducible. `fastprogress<1.1` keeps `fastprogress`
+# Phase 4 of nss_first_class_sampler — support package for `af.NSS`.
+#
+# The `handley-lab/blackjax` fork (BSD-3-Clause) carries the
+# `blackjax.ns.adaptive.init` entrypoint that mainline blackjax lacks, and
+# `yallup/nss` (BSD-3-Clause) sits on top. Both are pinned to specific SHAs
+# below — but installed manually rather than declared here, because PyPI and
+# TestPyPI reject direct `git+https://` URLs in uploaded wheels with:
+#
+#   400 Can't have direct dependency: blackjax @ git+...
+#
+# After `pip install autofit[nss]`, complete the install with:
+#
+#   pip install \
+#     "blackjax @ git+https://github.com/handley-lab/blackjax.git@ef45acd2f2fa0cca15adbdcd3ff7cb3a98987cb5" \
+#     "nss @ git+https://github.com/yallup/nss.git@69159b0f4a3a53123b9eec7df91e4ed3885e4dc4"
+#
+# blackjax SHA `ef45acd2` is the May 2026 "Merge PR #60 — double_compile"
+# revision, locally validated against the Phase 1-3 work. blackjax HEAD
+# (5dbf89a9 at pin time) introduced `numpy>=1.25`, which conflicts with
+# autofit's `anesthetic==2.8.14` (numpy<2.0) — bump only after both pins
+# move together. See PyAutoPrompt/issued/nss_install_simplification.md
+# notes #3-4 for context.
+#
+# `fastprogress<1.1` stays here as a regular PyPI dep — it keeps fastprogress
 # from pulling `python-fasthtml` (1.1.5 transitively requires it).
-# Re-pin SHAs periodically — see `autofit/install_nss.py` for the manual
-# fallback when pip's resolver cannot sequence the URL deps cleanly.
 nss = [
     "fastprogress<1.1",
-    # blackjax pinned to ef45acd2 (May 2026 "Merge pull request #60 — double_compile").
-    # Locally-validated against the entire Phase 1-3 nss_first_class_sampler work.
-    # HEAD as of pin time (5dbf89a9) introduced `numpy>=1.25` which conflicts with
-    # autofit's `anesthetic==2.8.14` (numpy<2.0). Bump only after both pins move
-    # together — see PyAutoPrompt/issued/nss_install_simplification.md notes #3-4.
-    "blackjax @ git+https://github.com/handley-lab/blackjax.git@ef45acd2f2fa0cca15adbdcd3ff7cb3a98987cb5",
-    "nss @ git+https://github.com/yallup/nss.git@69159b0f4a3a53123b9eec7df91e4ed3885e4dc4",
 ]
 docs=[
     "sphinx",