Reject a copyleft conjunct in an expression like '(MIT OR Apache-2.0)
AND GPL-3.0-only', which a permissive-alternative search accepted.
Discover python/*/pyproject.toml by glob, accept single-quoted TOML
literals, and fail on a requirement whose name cannot be read. Say that
the development tier records who declares a package rather than what a
build bundles, since a runtime dependency can pull one in transitively,
and sync the contributor guide's pre-commit list.