Update to Python 3

- Makefile with build/bump/release/verify targets using uv and macOS Keychain for token storage
- pyproject.toml: keywords, classifiers, Documentation URL, sdist include filter
- .gitignore: uv.lock, dist/, build/, *.egg-info/

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Promote ontology introspection out of the CLI layer into a storage-agnostic
diffbot.Ontology class so library consumers (e.g. langchain) can build valid
DQL on the fly, without depending on the disk-backed CLI cache.

- New diffbot/ontology.py: Ontology with types/composites/enums/taxonomies,
  fields_for, filter_fields, taxonomy_values, enum_values, find_named,
  format_field, plus from_json/from_path. Pure; imposes no caching policy.
- Client: dql_fetch_ontology() (sync + async) downloads and returns an
  Ontology; add async DiffbotAsync.dql_parallel() to mirror the sync one.
- cli/ontology.py now delegates to Ontology, keeping its ~/.diffbot disk cache
  and existing module API unchanged.
- tests/test_ontology.py covers the core, the HTTP fetch, and async parallel.

Also includes a pre-existing, in-progress credential-resolution refactor that
was already present in the working tree (diffbot/_auth.py and its consumers in
cli/_common.py, cli/dql.py, conftest, tests, README); __init__.py carries both
sets of changes, so they commit together.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

# Conflicts:
#	.gitignore
#	pyproject.toml

Run pytest on push/PR to main across Python 3.10-3.13 using the pinned
lockfile, plus a job that tests against the lowest allowed dependency
versions to catch range-compatibility breaks the lockfile would hide.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

0.2.0 shipped with a hardcoded __version__ = "0.1.0" that nothing kept in
sync with pyproject.toml. Read the version from importlib.metadata so the
package and module versions can never drift again.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

GitHub's Intel (macos-13) runners are being deprecated and their queue is
unreliable, which blocked the v0.2.2 release. Ship macOS as Apple Silicon
only; Linux keeps x86_64 + aarch64. Also add a concurrency group so
re-pushing a tag cancels an in-flight run, and a 30m build timeout so a
capacity-starved runner fails fast instead of hanging for 24h.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The release job downloads artifacts but never checks out the repo, so gh
could not infer the repository from a local git remote and failed with
"fatal: not a git repository". Pass --repo "$GITHUB_REPOSITORY" on every
gh release call.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>