feat(licensing): canonical license path fallback + uv-minor-patch bump, SQLAlchemy 2.1 (#1940)

[FabioLeitao]

Summary

• [P3][feat][licensing] DATA_BOAR_LICENSE_PATH: fallback ao path canônico org-wide quando não configurado #1940: LicenseGuard resolves the license path through core/licensing/paths.py. Precedence: DATA_BOAR_LICENSE_PATH, then licensing.license_path, then the org-wide canonical <user_config_dir>/databoar/license.jwt only when both are unset or blank and the file exists. An explicit value is never replaced, even when its file is missing (fail closed). The file found at the canonical path goes through the same signature and claim validation as any other. No new dependency (XDG, Darwin and Windows rules are hand-rolled).
• deps(uv): bump the uv-minor-patch group across 1 directory with 42 updates #2062 (Dependabot, uv-minor-patch, 42 updates): the same uv.lock content, re-signed here with requirements.txt and pylock.toml regenerated from it in the same commit (the dependency-artifacts-sync hook rejects a lock commit without them). SQLAlchemy 2.0.54 to 2.1.3 is accepted (operator decision, recorded in deps: triar a #2062 (grupo uv-minor-patch, 42 pacotes): sqlalchemy 2.1 decodifica o nome do banco e pylock.toml fora de sincronia #2069).
• deps: triar a #2062 (grupo uv-minor-patch, 42 pacotes): sqlalchemy 2.1 decodifica o nome do banco e pylock.toml fora de sincronia #2069: SQLAlchemy 2.1 percent-decodes the database segment, so core/findings_sink.py::_sqlalchemy_url now hands the raw name to the driver. core/findings_sink.py is unchanged. The existing assertion follows the new contract, and a new driver-level test pins the security invariant (see Verification).

Gate files

No file under .github/workflows/ and none of the tripwire gate files is touched, so no Gate-Change-Approved-By is needed.

Verification

• ./scripts/check-all.sh exited 0 on this branch: pre-commit, pytest 3229 passed, 82 skipped, shellcheck, bats 11/11, Rust guard (20 tests), Bandit, Zizmor, Gitleaks strict.

• Fail then pass ([P3][feat][licensing] DATA_BOAR_LICENSE_PATH: fallback ao path canônico org-wide quando não configurado #1940): with core/licensing/guard.py reverted to origin/main in a scratch copy, tests/test_license_canonical_path_fallback.py has 2 failures for the right reason (UNLICENSED, detail=missing_license_file instead of VALID: the canonical fallback and the whitespace-env case) and 5 passes (explicit env/config wins, no canonical file stays unlicensed, XDG). With the fix: 7 passed.

• Driver check (deps: triar a #2062 (grupo uv-minor-patch, 42 pacotes): sqlalchemy 2.1 decodifica o nome do banco e pylock.toml fora de sincronia #2069), psycopg2 2.9.13 with SQLAlchemy 2.1.3, no network: for audit?hostaddr=10.0.0.9, audit hostaddr=10.0.0.9, audit host=10.0.0.9 and audit=foo, create_connect_args keeps host=db.example.com with no hostaddr, and make_dsn then parse_dsn keeps dbname literal. test_sqlalchemy_connect_args_dbname_cannot_override_peer_psycopg2 asserts that, so the security test is stronger than before, not weaker.

• Windows test fix: d57c6440 test(licensing): make canonical path tests platform-aware (Windows APPDATA) isolates HOME, USERPROFILE and APPDATA and covers the linux, darwin and win32 branches of user_config_dir() on any OS.

Not verified

• psycopg 3 and pg8000: not project dependencies and not used by _sqlalchemy_url (it builds the default postgresql:// URL, psycopg2). Not exercised; nothing was installed outside the lock to check them.
• CI on this PR: hosted checks ran: 26 pass, 7 skipping (the expected skips), mergeStateStatus: CLEAN. The first run failed Test Windows (Python 3.12) with 4 tests: 3 were this PR's new tests (they assumed HOME/XDG, Windows resolves through APPDATA), fixed in d57c6440 with no change to core/licensing/. The 4th, tests/test_scan_abort_integrity.py::test_sqlite_localdbmanager_reopens_cleanly_after_abort ("subprocess not ready", fixed 10 s wait, subprocess stderr discarded), did not recur on the next run and its cause was not established; it was left untouched.
• [P3][feat][licensing] DATA_BOAR_LICENSE_PATH: fallback ao path canônico org-wide quando não configurado #1940 QA_LOCAL_LICENSE on a real host: exercised by tests with an isolated HOME, not on a machine with a real ~/.config/databoar/license.jwt.

Notes

• The Dependabot PR deps(uv): bump the uv-minor-patch group across 1 directory with 42 updates #2062 is left open on purpose: it becomes redundant once this merges and Dependabot closes it by itself. It must not be closed by hand.
• The ML-DSA and hybrid-license work (licensing: âncora ML-DSA embutida ausente e híbrido ainda opcional no guard (canon: Ed25519 + ML-DSA obrigatório) #2042, licensing: emissor de licença de dev (issue_dev_license_jwt.py) não emite ML-DSA — quebra o Maestro quando o híbrido for obrigatório #2043) is deliberately untouched.

Closes #1940
Refs #2069
Refs #2062

🤖 Generated with Claude Code

https://claude.ai/code/session_0142QEjA7eEFcdXTpcTmcAZk