Adopt hatch-vcs for tag-driven versioning

[randileeharper]

Summary

Replace the static version = "0.1.0" in pyproject.toml with a dynamic version derived from git tags via hatch-vcs, so cutting a release is just git tag vX.Y.Z && git push — no manual version bump. Mirrors the intent of magpie#74.

No source code changes required: vesper/__init__.py already reads the version via importlib.metadata.version("vesper") (with a 0.1.0 fallback for source-tree runs), and vesper/a2a.py surfaces __version__ in the A2A agent card and FastAPI app. Because the version is already sourced from distribution metadata, this is purely a build-configuration change plus the release/CI workflows and the lockfile.

Changes

• pyproject.toml — make version dynamic; add hatch-vcs to [build-system].requires; add a [tool.hatch.version] block (source = "vcs", fallback-version = "0.0.0"). The fallback ensures builds never hard-fail in environments lacking git metadata (e.g. GitHub source archives), while real releases still resolve the correct tag.
• .github/workflows/release.yml & .github/workflows/ci.yml — add fetch-depth: 0 to actions/checkout. Without this, the shallow checkout causes hatch-vcs/setuptools-scm to resolve the version to the 0.0.0 fallback — in CI this is silent because the version-matching test (test_agent_card_version_matches_package_metadata) would pass with both sides equal to 0.0.0, and in release it would ship a broken 0.0.0 release.
• uv.lock — regenerated. The root vesper package entry no longer pins version = "0.1.0" (now resolved at build time). Note: uv lock also refreshed incidental environment-marker metadata on two transitive deps (aiologic, culsans) — these are benign registry-metadata refreshes, not caused by hatch-vcs.

Verification

Run from the feature branch (2 commits past the v0.1.0 tag, so a dev version is the expected, correct result — proves tag-driven versioning is working rather than resolving to 0.0.0 or a hardcoded literal):

uv build
# -> dist/vesper-0.1.1.dev2+g18e1d0763.d20260629-{py3-none-any.whl,.tar.gz}

uv run python -c "import importlib.metadata as m; print(m.metadata('vesper')['Version'])"
# -> 0.1.1.dev2+g18e1d0763.d20260629

uv run python -c "from vesper import __version__; print(__version__)"
# -> 0.1.1.dev2+g18e1d0763.d20260629

uv run ruff check vesper tests
# -> All checks passed!

uv run mypy vesper
# -> Success: no issues found in 37 source files

uv run pytest -q
# -> 281 passed

Also confirmed the tagged commit itself (v0.1.0 @ 786bdcf) yields a clean 0.1.0 via a scratch git worktree:

git worktree add ../vesper-tag-check 786bdcf
(cd ../vesper-tag-check && uv build && ls dist/)
# -> vesper-0.1.0-py3-none-any.whl, vesper-0.1.0.tar.gz
git worktree remove ../vesper-tag-check

The key regression test tests/test_a2a.py::test_agent_card_version_matches_package_metadata (asserts the agent-card version equals vesper.__version__) continues to pass — both derive from the same dist metadata.