fix(template): stabilize copier update and unbreak the first commit

[ichoosetoaccept]

Summary

Four commits that make copier update safe to run on a released project, plus the
dependency bump they were tested against.

Commit	What
dcf0f7f	Upgrade dependencies; raise floors to the tested versions (ruff 0.16.1, ty 0.0.66, prek 0.4.12). Carries copier 9.17.1, a security release.
b40cc5a	Preserve project.version and tool.semantic_release.tag_format across updates.
1fc4bbc	Match uv's own uv_build pin; raise the floor to 0.12.1.
a68a425	Stop coverage's sysmon core breaking the first commit in a fresh project.

Why

b40cc5a is the one worth reading closely. sync_marked_sections.py regenerates
pyproject.toml in full from the template and splices back only marked regions.
project.version and tag_format are owned by neither the template nor the user but
by python-semantic-release, which rewrites them in the project between updates — so a
fresh render resets them to the seed 0.0.0 / {version}.

Markers cannot fix this. A project updating from a marker-less version has no
snapshot to splice, so its first update — the one that matters — would still reset
them. Preservation is therefore by key path, which needs no downstream action.

One subtlety in the implementation: the table-end scan requires a whole-line bracketed
header. A bare ^\[ truncates [tool.semantic_release] at the column-0 shell guards
inside the multi-line build_command, which sit before tag_format — preservation
would have silently no-opped on the real template while passing synthetic tests. There
is a regression test for exactly that shape.

a68a425 fixes a live breakage. The first git commit in any freshly scaffolded
project currently fails. coverage selects the sys.monitoring core by default on
CPython 3.14+, that core cannot do dynamic contexts, pytest-testmon uses them, and
filterwarnings = ["error"] promotes coverage's warning into an INTERNALERROR.
Fixed by scoping COVERAGE_CORE=ctrace to the testmon hook via prek's per-hook env,
so pytest-cov keeps the faster core. Silencing the warning was rejected: testmon uses
those contexts to pick which tests to run, so incomplete data would keep the hook green
while selecting the wrong tests.

1fc4bbc changes nothing structural. uv 0.12 made uv init emit [build-system]
with uv_build by default, converging on what this template already generated. The
upper bound stays because it is uv's recommendation, not ours.

Test plan

• pytest tests/test_template_lint.py — 39 passed (all boolean answer combinations render valid TOML/YAML)
• pytest tests/test_template.py::TestIntegration::test_first_commit_succeeds_with_prek_hooks — passes; this is the test that was failing before a68a425
• New regression tests: released version and tag_format survive an update; the table scan survives the build_command shell guards; an absent scalar keeps the fresh seed; the rendered pyproject.toml is both readable and rewritable by the preservation code
• New fast guard asserting the rendered testmon hook carries COVERAGE_CORE=ctrace via prek's env key rather than an entry prefix (the CI matrix includes Windows, where an env VAR=value prefix would not work)
• End-to-end: rendered a real project, confirmed 0.18.0 and v{version} survive an update while line-length still tracks the template

Refs DOT-620

Greptile Summary

This change updates generated-project dependency floors, raises the uv build-backend requirement, preserves semantic-release-managed version metadata during Copier updates, and configures the testmon hook to use coverage’s C tracer core on Python 3.14+.

A real Copier update from the pre-change template to this revision was exercised with a released project.version and a custom tool.semantic_release.tag_format. Both values remained intact after the update, while template-owned configuration—including the updated uv_build requirement—was refreshed. Focused tests also passed for scalar preservation, rendered configuration shape, and the multiline semantic-release build-command case.

No defects were found.

Confidence Score: 5/5

Safe to merge based on the exercised Copier update flow and focused regression coverage.

No defects remain after validating that release-managed metadata survives a real update while fresh template-owned configuration is applied.

Files Needing Attention: None.

T-Rex Logs

What T-Rex did

• Ran the reproducible Copier semantic-release update-flow validator to generate a semantic-release-enabled project from the pre-change template, apply version and tag_format changes, and run a Copier update against the revision, and the updated project retained both release-managed values, adopted the uv_build>=0.12.1,<0.13 requirement, retained the multiline UV_CACHE_DIR build-command guard, and passed four focused tests.
• Captured baseline and after-update states, plus focused regression-test output, to verify the update flow.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "fix(template): stop coverage sysmon core..." | Re-trigger Greptile}

[linear-code]

DOT-620

[ichoosetoaccept]

This change is part of the following stack:

• fix(template): stabilize copier update and unbreak the first commit #345 ◀
  • ci: bump pinned actions and SHA-pin generated workflows #344

_{Change managed by git-spice.}