Add dependency safeguards: deptry, pre-commit, declare pandas

[turbomam]

Summary

• Declare pandas explicitly in pyproject.toml — used directly by the metatraits transform but was only resolved transitively through pyobo/kgx
• Add deptry to dev dependencies to catch undeclared imports and stale deps
• Add .pre-commit-config.yaml wiring up ruff, codespell, and deptry (all three were configured in pyproject.toml but not enforced via hooks)
• Add [tool.deptry] config excluding notebooks and docs dirs

Context

Found while reviewing the poetry.lock diff in #490 — 7K lines changed with only 1 declared new dep. Opened as #491.

Note: GitHub reports 33 known vulnerabilities on the default branch. Adding pip-audit or safety as a follow-up would help catch these in CI.

Closes #491

Test plan

• poetry install resolves cleanly with the new pandas declaration
• pre-commit run --all-files passes (or surfaces known issues to fix)
• deptry . reports no undeclared transitive imports

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds explicit dependency and developer tooling safeguards to prevent undeclared/transitive dependency breakage and to enforce repo hygiene via pre-commit.

Changes:

• Declare pandas as a direct runtime dependency.
• Add deptry to dev dependencies and configure it to exclude notebooks/ and docs/.
• Introduce .pre-commit-config.yaml to run ruff, codespell, and deptry via hooks.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
pyproject.toml	Adds pandas and deptry, plus deptry config exclusions.
.pre-commit-config.yaml	Wires ruff, codespell, and deptry into pre-commit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This introduces ruff-format in pre-commit, but the repo’s existing formatting workflow uses black (see tox.ini testenv:format). Unless the project is intentionally migrating away from Black, this will lead to inconsistent formatting between pre-commit and tox -e format/developer workflows; consider either adding a Black pre-commit hook or updating tox/config to use Ruff formatter consistently (and align line-length settings).

Suggested change

	- id: ruff-format
	- repo: https://github.com/psf/black
	rev: 24.4.2
	hooks:
	- id: black

[Copilot]

The pre-commit hooks pin specific tool versions (ruff-pre-commit rev and deptry rev), but pyproject.toml allows much older versions (e.g., ruff = ">=0.2.1", deptry = ">=0.16.0"). This can cause confusing drift where poetry run ruff/deptry behaves differently from pre-commit; consider pinning the Poetry dev dependency versions to match the hook revs (or vice versa) to keep results consistent.

Suggested change

	rev: 0.23.0
	rev: 0.16.0

[Copilot]

pandas and deptry are added/updated in pyproject.toml, but this PR doesn’t update poetry.lock. With a committed lockfile, poetry install (including CI) will fail with a "pyproject.toml changed significantly" error until the lock is regenerated and committed (e.g., poetry lock / poetry update pandas deptry).