build(deps): single-source package versions and unify python dependencies (ADR-1236)

[lusoris]

Summary

The vmaf Python runtime dependency list was maintained in three files. Make python/pyproject.toml its owner, derive python/requirements.txt, remove the duplicate setup.py list, and exclude the generated requirements file from Renovate. A local/CI hook checks ordered dependency entries.

Add checks for release-owned product-version and Python CI mirrors. Align the existing vmaf-tune package marker and dev Optuna requirement. Scientific dependency floors remain owned by package manifests; five initially proposed global variables had no consumers or checks and have been removed.

Rebased onto the current #1396 hygiene parent. The reviewed tree preserves its newer NumPy 2.5.3, PyWavelets 1.10.0 and MCP requirements, the repaired Renovate patterns, both base-image regression hooks, and Level Zero container validation. Native ORT archive roles remain separate from Python dependency floors and are documented in docs/development/base-images.md.

Fix pre-push mypy selection to enforce the existing AGENTS.md §12.10 merge-base policy. A rebase can leave a branch-owned Python file unchanged while changing the type of an imported function on master; the old-tip/new-tip filename list then omits the file that must be rechecked. The hook derives the complete ai//scripts/ Python set, includes Git type changes, preserves safe internal symlink names and rejects outgoing refs different from the checked-out HEAD. Twelve real-Git regressions include execution through installed pre-commit with an empty outgoing diff.

This PR remains a held draft. Full integration acceptance is pending on #1396; the merge train must not promote or merge this stack.

Validation

• 17 base-image/Level Zero tests and three Renovate pattern tests pass. The new entrypoint regression fails when the workflow-checker refactor drops container validation.
• Actual requirements generation/check passes with all 13 current runtime dependencies. The workflow/version checker passes against the reviewed tree.
• Twelve mypy scope regressions pass, including actual pre-commit invocation across a real Git rebase and empty outgoing diff. Strict mypy passes all 17 Python files owned by the combined branch against master merge-base 78c9d2bfc.
• Normal pre-commit, commit-message and pre-push hooks pass without bypass, including formatting, shell checks, generated docs, FFmpeg cumulative replay, configuration guards and strict MkDocs. The PR body independently passes the deliverables validator against current stacked parent 851d53dc8.
• Full make lint and make test, package build/runtime acceptance and hosted checks remain pending. A metadata gate is not scientific training validation.

Bug-status hygiene

• docs/state.md records the unused-owner and rebase-consumer correction.
• docs/state.md records the pre-push rebase-scope correction, which implements the existing touched-file policy (no new ADR needed).
• Netflix golden-score assertions are unchanged.

Deep-dive deliverables

• Research digest — docs/research/1236-version-single-source-tree.md, updated to distinguish the original inventory from the reviewed ownership boundaries.
• Decision matrix — docs/adr/1236-version-single-source-tree.md.
• AGENTS.md invariant note — compat/python-vmaf/AGENTS.md records dependency ownership and generated requirements; scripts/AGENTS.md records complete merge-base Python selection and fail-closed ref/path checks.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — changelog.d/changed/version-single-source-tree.md and changelog.d/fixed/pre-push-mypy-merge-base-scope.md.
• Rebase note — docs/rebase-notes.md records the metadata and consumer contracts.

Reproducer

make python-deps-sync
python3 scripts/ci/check-workflow-versions.py
python3 -m unittest discover -s scripts/ci/tests -p 'test_*single_source.py'
python3 -m unittest discover -s scripts/ci/tests -p test_renovate_file_patterns.py
python3 scripts/git-hooks/test-pre-push-mypy.py
python3 scripts/git-hooks/pre-push-mypy.py

[lusoris]

Superseded by the pre-rc.1 fixing train in #1425.

Verified by comparing this branch's tree against the train for every path its commits touch: zero differences. Its own commits are on the train already, and everything else it carried was the base-image chain that #1396's squash put on master on 2026-09-15.

Closing is safe; nothing here is lost. If you would rather keep it open until #1425 merges, that works too — it just has nothing left to contribute.

[lusoris]

Superseded by the pre-rc.1 fixing train in #1425.

Closing because the ADR Collision Guard — a required check — fails #1425 while both PRs claim ADR-1236. Verified before closing:

• Six of the seven ADRs this branch adds are byte-identical in fix(rc1): integrate configuration, hooks and runtime repairs #1425.
• The seventh, ADR-1231, differs only because the train's copy has more: a 2026-09-08 verification-update section on the ROCm 26.04 restoration that this branch predates.
• The branch's own two commits are on the train. Everything else it carried was the base-image chain that build(docker): define every container base image in one config file (ADR-1231) #1396's squash put on master on 2026-09-15, which is why a plain rebase of this branch replays eight commits master already has.

The branch is untouched, so this is reversible.