chore(ci): route Python package installs through AWS CodeArtifact

[huahq]

Summary

Migrates this repo's Python installs to AWS CodeArtifact per go/migrate-to-ca:

• pyproject.toml — adds a [[tool.uv.index]] entry (default = true) pointing uv at https://nextdoor-364942603424.d.codeartifact.us-west-2.amazonaws.com/pypi/kingpin.git/simple/. Auth comes from ~/.netrc locally and UV_INDEX_CODEARTIFACT_* env vars in CI — no tokens in committed config.
• test.yaml / main-release.yaml / publish-release.yaml — adds OIDC permissions, a Nextdoor/actions/aws-login step (codeartifactPip: true for any stray pip usage), and exports the CodeArtifact token as UV_INDEX_CODEARTIFACT_USERNAME/PASSWORD for all uv steps. codeartifactPip alone is insufficient here because uv does not read pip.conf.
• docs/development.rst — contributor note on registry auth.

⚠️ Merge blockers (in order)

• Create the CodeArtifact repository — kingpin.git does not exist in the nextdoor domain (verified via describe-repository / list-repositories-in-domain). Someone with access (or via nextdoor/codeartifact-subsys if repos are provisioned there) must run:

  aws --region us-west-2 codeartifact create-repository \
    --domain nextdoor --domain-owner 364942603424 \
    --repository kingpin.git \
    --upstreams repositoryName=upstream-pypi

• Regenerate uv.lock against CodeArtifact (uv lock with fresh CA auth) and push to this branch. This is not optional: verified empirically that uv sync --frozen downloads from the URLs baked into uv.lock (currently files.pythonhosted.org) and ignores the configured index for locked packages — without a re-lock, CI would silently keep hitting PyPI and break the day it's blocked. uv has no index-mirroring mechanism (Request for uv.lock to support different index urls across different developer machines and CI environments astral-sh/uv#6349).
• Verify with PyPI black-holed: uv sync --frozen --no-cache with pypi.org/files.pythonhosted.org unreachable must succeed using only the CA URL.

Things to be aware of

• This repo is public OSS. After the re-lock, uv.lock will contain CodeArtifact URLs that require Nextdoor AWS credentials even for reads — external contributors will not be able to uv sync, and fork PRs cannot assume the OIDC role, so test.yaml will fail for them. If external contribution matters, that's a decision to make before merging.
• Renovate updates pyproject.toml/uv.lock natively; after migration it needs CodeArtifact credentials (hostRules) or its lock-file updates will fail.
• ReadTheDocs is unaffected — it installs via pip (.readthedocs.yaml), which ignores [tool.uv] config and keeps using public PyPI.
• PyPI publishing is unaffected — pypa/gh-action-pypi-publish still publishes to public PyPI.
• CI on this branch is expected red until the first two checkboxes are done.

🤖 Generated with Claude Code