Check dependency declarations against the version policy

The decidable half of the `/repomatic-deps review` checklist: upper bounds,
missing floors, unsorted lists, misplaced type stubs and uncommented floors
are all readable from `pyproject.toml`, so they belong in `lint-deps` rather
than in a skill a maintainer has to remember to run. Whether a floor is
*justified* by the APIs the code calls stays where it was, since nothing
settles that by parsing.

Findings are warnings and never reach the exit code, keeping them clear of
the shippability gate that does block a release.

Author: kdeldycke

changelog.md

@@ -9,6 +9,7 @@
 - New `repomatic run <tool> --verify` reporting which files a formatter would rewrite, without touching the working tree.
 - `repomatic run` now resolves a tool's targets itself when given no arguments, running the invocation CI performs. A tool with no matching file is skipped instead of invoked pathless.
 - `lint-changelog` now warns about a released section holding no entry.
+- `lint-deps` now reports declarations departing from version policy: upper bounds, missing floors, unsorted lists, misplaced type stubs, uncommented floors. Warnings only, disabled with `--no-policy`.
 - `cancel-runs` now spares a run whose head commit carries `[changelog] Release`, so a sweep of the default branch cannot kill a release matrix.
 - Fix the `[tool.repomatic.workflow]` key names the `repomatic-audit` skill recommends: they are `extra-paths` and `ignore-paths`, not the snake_case attribute names.
 

docs/repomatic.md

@@ -137,6 +137,15 @@
    :undoc-members:
 ```
 
+## `repomatic.dep_policy` module
+
+```{eval-rst}
+.. automodule:: repomatic.dep_policy
+   :members:
+   :show-inheritance:
+   :undoc-members:
+```
+
 ## `repomatic.dep_report` module
 
 ```{eval-rst}

docs/tests.md

@@ -135,6 +135,15 @@
    :undoc-members:
 ```
 
+## `tests.test_dep_policy` module
+
+```{eval-rst}
+.. automodule:: tests.test_dep_policy
+   :members:
+   :show-inheritance:
+   :undoc-members:
+```
+
 ## `tests.test_dep_report` module
 
 ```{eval-rst}

repomatic/cli.py

@@ -97,6 +97,7 @@
     generate_dependency_graph,
     resolve_subgraph_selection,
 )
+from .dep_policy import scan_policy
 from .dep_sources import (
     LINT_DEPS_HEADER_DEFS,
     build_release_readiness,
@@ -1950,6 +1951,15 @@ def lint_changelog(
         " pushes."
     ),
 )
+@option(
+    "--policy/--no-policy",
+    default=True,
+    help=(
+        "Also report declarations departing from the project's version"
+        " policy: upper bounds, missing floors, unsorted lists, misplaced"
+        " type stubs, uncommented floors. Never blocks a release."
+    ),
+)
 @option(
     "--output",
     type=file_path(writable=True, resolve_path=True, allow_dash=True),
@@ -1963,6 +1973,7 @@ def lint_deps(
     pyproject_path: Path,
     lockfile: Path,
     fatal: bool,
+    policy: bool,
     output: Path | None,
     output_format: str,
 ) -> None:
@@ -2014,20 +2025,26 @@ def lint_deps(
         allow=config.lint_deps.allow,
     )
 
-    if not findings:
+    policy_findings = scan_policy(pyproject_path) if policy else []
+
+    if not findings and not policy_findings:
         echo("✓ Every dependency resolves from the public package index.")
         ctx.exit(0)
 
-    rows = [
-        (
-            finding.package,
-            str(finding.kind),
-            finding.location,
-            finding.verdict,
-        )
-        for finding in findings
-    ]
-    ctx.print_table(rows, LINT_DEPS_HEADER_DEFS)
+    if not findings:
+        echo("✓ Every dependency resolves from the public package index.")
+
+    if findings:
+        rows = [
+            (
+                finding.package,
+                str(finding.kind),
+                finding.location,
+                finding.verdict,
+            )
+            for finding in findings
+        ]
+        ctx.print_table(rows, LINT_DEPS_HEADER_DEFS)
 
     blocking = [finding for finding in findings if finding.blocking]
     for finding in findings:
@@ -2040,6 +2057,12 @@ def lint_deps(
             emit_annotation(AnnotationLevel.WARNING, finding.message)
             echo(f"⚠ {finding.message}")
 
+    # Style findings render after the shippability ones and never reach the
+    # exit code: a release is not held for an uncommented floor.
+    for policy_finding in policy_findings:
+        emit_annotation(AnnotationLevel.WARNING, policy_finding.message)
+        echo(f"⚠ {policy_finding.message}")
+
     if output:
         log_output_target("dependency blockers", output)
         emit_report(