feat(pyscn): integrate pyscn code quality gate into CI

[dlstadther]

Summary

• Adds pyscn (CFG-based dead code detection, cyclomatic complexity, clone detection, coupling/dependency analysis) as a dev dependency
• Wires pyscn check . into the make lint chain (new lint-quality target), the pre-commit hooks (local hook, same language: system pattern as pyrefly), and a new "Quality check with pyscn" step in the CI lint job
• Configures pyscn via [tool.pyscn.*] sections in pyproject.toml (matching this repo's convention of keeping tool config there, rather than a dedicated .pyscn.toml): full output/complexity sections, dead_code/cbo trimmed to their enabled toggle, architecture disabled (flat single-package library, not a layered app). clones/analysis are left on pyscn's built-in defaults since neither has an enabled toggle in its schema. Links to the full config reference (https://docs.codescan.dev/configuration/reference/) for anyone tuning it further.
• Adds .pyscn/ (report output dir) to .gitignore
• Ran pyscn analyze . manually once (full report, not committed): health score 88/100 (B) — no complexity, dead code, duplication, or coupling issues; only a minor cohesion (LCOM) note on 2 classes

Test plan

• make lint-quality passes locally
• make format / make lint-python / make lint-sql / make type / make test all pass
• uv lock / uv sync --all-extras succeed with the new dependency
• CI tests.yml lint job runs the new step
• Confirmed pyscn picks up [tool.pyscn.*] from pyproject.toml and reproduces the same 88/100 health score as before the config existed

🤖 Generated with Claude Code

https://claude.ai/code/session_01EEpPSmBaxSif7DbNLcFXZM

[dlstadther]

Let's go ahead and add the toml config file. Start it with reasonable defaults. I want this to be a starting place for configurability.

[dlstadther]

Added .pyscn.toml in 0f017c5 (generated via pyscn init), so it's now the starting point for tuning thresholds going forward.

One call I made: the generated file ships example layered-architecture rules (presentation/application/domain/infrastructure package-name matching). This repo is a flat single package (src/sample/*), so I disabled that section ([architecture] enabled = false) rather than leave it live — with it on, it misclassified modules and dropped the architecture score to 71% for no real reason. Left the layer/rule definitions in as commented-out examples for when the project grows into distinct layers.

Everything else keeps pyscn's own defaults, and confirmed the health score (88/100, B) is identical with the config file present vs. absent.

[dlstadther]

I'll group a few update requests into a single comment here:

• Keep the "output" section
• Keep the "complexity" section
• Reduce the "dead_code", "clones", "cbo", and "analysis" sections to just their "enabled" attribute.

[dlstadther]

Done in 45fa4c7, with one caveat: kept output and complexity in full, and reduced dead_code/cbo to just enabled = true as asked.

For clones and analysis, though — pyscn's config schema doesn't actually define an enabled field on either (confirmed against https://docs.codescan.dev/configuration/reference/; clones starts straight into fragment-selection params like min_lines, and analysis is just file-discovery patterns). So there's no toggle to reduce those sections to. I omitted both sections entirely instead, letting pyscn's own defaults apply — functionally the closest equivalent to "just the enabled attribute," but flagging it in case you wanted something else here (e.g. keeping one of them in full, or dropping min_severity/exclude patterns from dead_code/analysis instead). Leaving this thread open in case that's not what you meant.