Five published distributions still serve Requires-Dist: argh though every source tree is clean

[thorwhalen]

Every source tree in the fleet is clean of argh. Five things people can pip install are
not. That gap is the one thing the argh -> cw programme set out to close and did not, and
it is invisible from the repos: each of these five greps clean, sits on its default branch
with a clean tree, and shows a merged PR.

Measured against the PyPI JSON API today, over 62 fleet distribution names:

distribution	PyPI version	source	why the fix never shipped
coact	0.0.4	clean (coact#42, merged)	[tool.wads.ci.publish] enabled = false
ke	0.1.1	clean	publish disabled deliberately — see ke#12, the name is parked for a future package
pipoke	0.0.23	clean	publish job failed: twine upload -u -p ran with both empty. Already tracked at thorwhalen/pipoke#4
oui	0.3.3	clean (oui#21, merged)	repo has zero Actions workflows
py2dash	0.0.2	clean	repo has zero Actions workflows

oui already has a manual-task issue: i2mint/oui#22. This issue is the other four plus
the shared decision.

i2mint/oui_notebook had the same shape (declaration removed in oui_notebook#2, no CI) but
is harmless: it has never been on PyPI under either spelling, so no published artifact of it
ever carried the declaration.

Why it matters

argh is LGPL-3.0-or-later, outside the fleet's MIT/BSD/Apache/ISC perimeter. Clearing
that exposure is the entire reason the programme existed. A Requires-Dist: argh on PyPI is
the exposure — it is what a resolver acts on and what a licence audit of an installed
environment sees. The source being clean does not help anyone who installs the package.

Two of the five are also plain broken for users: coact and ke published sdists that
import argh while their metadata is the pre-migration one, so a fresh install can fail at
import. (theremin is the same class and already has its own issue, thorwhalen/theremin#11.)

The decision that is yours

For each of the four, one of:

1. Cut a release. For coact this is flipping enabled = true and merging. For the
   others it needs credentials or CI that does not exist yet.
2. One-off manual upload — uv build && uv publish from your machine, no stored secret.
   Fastest for oui and py2dash, which are dormant and do not justify standing up CI.
3. Yank / accept. ke is deliberately unpublished going forward and py2dash is dead;
   deciding "we accept a stale artifact on PyPI for these" is a legitimate answer, but it
   should be a decision on the record rather than a thing nobody noticed.

An agent cannot do any of them: (1) and (2) need a PyPI token, and (3) is a judgement call.

The process lesson, for the ledger

The fleet ledger tracked merged, and treated it as equivalent to done. For every
repo without working publish CI those two facts silently diverged, and the ledger showed
green for an exposure that was still being served. Any future fleet-wide dependency
campaign should verify the artifact, not the repo — the check is one call to
https://pypi.org/pypi/{name}/json and a look at info.requires_dist.

Close-out context: #28, #30, and https://github.com/thorwhalen/priv/discussions/65