Consolidate test & dev workflows into tox as single source of truth (#160)

* Centralize all Python environments on tox

tox.ini is now the single source of truth for how every Python
environment runs — tests, linting, formatting, dev server, and CI.
No more bare `poetry run` outside of tox.

- Expand tox.ini from 4 to 15 environments (lint, format, typecheck,
  unit, integration, functional, e2e, fast, ollama, ci, coverage,
  coverage-html, pre-commit, dev, all)
- Rewire all Makefile test/lint/format/dev targets to delegate to tox
- Update .githooks/pre-commit to run `tox -e pre-commit`
- Update .pre-commit-config.yaml to use tox instead of poetry run
- Update CI workflow (lint + test jobs) to use `tox -e lint` and
  `tox -e ci` instead of ad-hoc pytest/black/isort invocations
- Update CLAUDE.md to mandate tox usage and document all environments

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

* refactor: modernize tox.ini for tox 4.x conventions

- Replace `skipsdist = true` (tox 3 alias) with `no_package = true`
- Use `poetry install --no-root --sync` for faster, cleaner dep installs

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

* fix(ci): drop poetry install from lint/format tox envs

Lint and format only need black, isort, and bandit — not the full
project dependency tree. Override commands_pre to empty and use tox
deps instead. Fixes CI failure where poetry is not on PATH.

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

* fix(ci): remove poetry run wrapper from all tox commands

Since commands_pre runs poetry install into the tox-managed venv,
all tools (pytest, mypy, black, etc.) are already on the venv PATH.
The poetry run wrapper is redundant and fails in CI where poetry
may not be installed globally.

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

* fix(ci): remove poetry dependency, align local and CI processes

- Replace `poetry install` with `pip install -e ".[dev]"` in tox
  commands_pre so all envs work without poetry installed
- Remove Poetry cache from GitHub Actions (only pip cache needed)
- Rename pre-commit env to pre-push: runs lint + full CI suite
  (same checks as GitHub Actions, reports generated locally)
- Update CLAUDE.md to reflect new pre-push workflow

The local `tox -e pre-push` now runs the exact same lint + test +
coverage checks as CI, so failures are caught before pushing.

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

---------

Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/tests.yml

@@ -16,17 +16,11 @@ jobs:
         with:
           python-version: "3.11"
 
-      - name: Install linters
-        run: pip install black==26.3.0 isort==5.13.2 bandit==1.8.0
+      - name: Install tox
+        run: pip install tox
 
-      - name: Check formatting (black)
-        run: black --check --line-length 100 src/ tests/
-
-      - name: Check import order (isort)
-        run: isort --check --profile black --line-length 100 src/ tests/
-
-      - name: Security scan (bandit)
-        run: bandit -r src/ -ll -s B101,B104,B307,B310,B324,B601,B608 -q
+      - name: Lint (black + isort + bandit via tox)
+        run: tox -e lint
 
   test:
     runs-on: ubuntu-latest
@@ -45,31 +39,18 @@ jobs:
         with:
           python-version: "3.11"
 
-      - name: Cache Poetry virtualenv
+      - name: Cache pip
         uses: actions/cache@v4
         with:
-          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
-          key: poetry-${{ hashFiles('poetry.lock') }}
-          restore-keys: poetry-
+          path: ~/.cache/pip
+          key: pip-${{ hashFiles('poetry.lock') }}
+          restore-keys: pip-
 
-      - name: Install dependencies
-        run: |
-          pip install poetry
-          poetry install --with dev
+      - name: Install tox
+        run: pip install tox
 
-      - name: Run tests
-        run: |
-          mkdir -p reports
-          poetry run pytest \
-            --cov=src \
-            --cov-report=term-missing \
-            --cov-report=xml:reports/coverage.xml \
-            --cov-fail-under=73 \
-            --junitxml=reports/junit.xml \
-            -p no:xdist \
-            -m "not ollama and not docker and not selenium and not external_api"
+      - name: Run tests (via tox)
+        run: tox -e ci
 
       # Posts a check annotation + PR comment showing pass/fail counts.
       # Visible in the GitHub mobile app under Checks and in PR conversations.