chore: add isort to Pipfile's dev-packages so make isort resolves it

[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — changelog centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• chore — anything else

---

Description

make isort drives its four recipe lines through pipenv run, which resolves against Pipfile's [dev-packages] — where isort was missing, though mypy, pylint and bandit all sit there. #786 put isort on the test extra only, so a pipenv install --dev environment could not run the recipe.

Added isort = "*" between bandit and mypy, bare like its neighbours. Additive only: the pyproject.toml extra serves consumers of the published package, Pipfile this repo's dev environment — nothing removed from either.

tests/project/test_isort_clean.py's docstring asserted the gap was still open ("isort remains absent from Pipfile"); this change makes that stale, so it is corrected.

Audit of every Makefile-invoked executable vs [dev-packages] — isort was the only omission:

Tool	Makefile	Pipfile
isort	133–136	was missing → added
build / twine	63 / 66–68	present
pytest / coverage	88, 92, 121 / 95–96	present
sphinx / sphinx-autobuild	124 / 130 via docs/Makefile	present
vermin / pylint / mypy / bandit	182 / 185 / 188 / 191	present
pcapkit-vendor	78	present, via editable pypcapkit

Pipfile.lock is untracked (.gitignore:37, absent from disk) and make pipenv uses --skip-lock, so no lock refresh applies. Noted in passing, not fixed here: profile: (194) delegates to test/, which no longer exists.

Verified: tests/project/ 127 passed / 490 subtests, with test_isort_clean running for real (4 subtests, not skipped); tests/test_tier_guard.py 102 passed / 540 subtests. No test reads Pipfile from disk, so the new line changes no test's behaviour.

Closes #810

[JarryShaw]

Cross-review verdict: GOOD TO GO (sonnet; author was haiku). Every claim re-derived independently, nothing found inaccurate.

The Makefile audit reproduces exactly — isort was the only omission. The reviewer read the whole Makefile rather than grepping, and confirmed the trap the author flagged: grep -n "pipenv run" Makefile returns 20 lines but silently misses vermin, vermin-ci, pylint, mypy, bandit at :172, :182, :185, :188, :191, which route through $(RUN) (Makefile:144, RUN ?= pipenv run). Caught with grep -n '\$(RUN)' as the negative-catching probe. All eleven other tools present, including pcapkit-vendor as a console script of the editable install (pyproject.toml:107).

The docstring rewrite is necessary, not scope creep. The old prose said "isort remains absent from Pipfile… Out of scope here" — fixing #810 makes that a false statement in the tree, so leaving it would have been worse than the edit. The new text states a durable structural fact (which file make isort reads versus which serves published-package consumers) rather than something that drifts.

Pipfile.lock: all three sub-claims confirmed — .gitignore:37 is exactly Pipfile.lock, the file is absent from disk, and Makefile:75 is pipenv install --skip-lock --dev. So no lock refresh arises and none was performed.

The skip-vs-run distinction was verified rather than trusted, which is the right instinct since a silent skip is the exact defect #810 is about: HAS_ISORT evaluates True, _isort_recipe_line_numbers() returns exactly 4 entries matching MAKEFILE_LINES, so four real isort --check-only subprocesses run. And it self-tested the gate by monkeypatching find_spec to return None, confirming HAS_ISORT flips to False — proving the gate distinguishes ran from skipped rather than always reporting the same thing. tests/project/ 127 passed / 490 subtests, matching the author exactly.

The two flagged non-fixes confirmed and correctly left out: Makefile:193-194's profile: delegates to $(MAKE) -C test profile while test/ has zero tracked files and does not exist — a dead target; and snakeviz/tuna sit in [dev-packages] with no recipe touching them. Both pre-existing and orthogonal to #810; a follow-up, not a blocker here.

Flipping to review: good-to-go.