Upgrade to Python 3.11

[olmos-keepsafe]

Key changes

• Migrates packaging from setup.py / setup.cfg to pyproject.toml, sets Python policy to 3.11, and bumps the package version to 1.0.0.
• Hard-pins runtime/dev dependencies and upgrades Python 3.11 blockers. The final runtime targets include the team-required aiohttp==3.13.2, beautifulsoup4==4.15.0, lxml==6.0.2, Markdown==3.10.2, parse==1.22.1, and KeepSafe sdiff==1.1.0 from immutable html-structure-diff commit 7cac22038c90708296789197d8492d8aa16087be; coverage is refreshed to 7.15.2.
• Confirms msgpack is not a content-validator dependency or source/test concern, so libks msgpack compatibility wrappers are not applicable here.
• Replaces nose with pynose, moves Flake8 config into pyproject.toml, and keeps sample-style PYNOSE_SHARED_FLAGS plus CI coverage/xUnit artifact flags.
• Adds fixture-backed golden compatibility tests for markdown diff shape, Java placeholders, and URL extraction.
• Adds a minimal content-validator CLI help/version smoke surface because package metadata already declared the console script.
• Updates Makefile, README, Travis, requirements, git hook wiring, and a repo-specific migration contract.
• Adds a native CircleCI 2.1 config using reusable executors and commands, with prepare_cache, lint, and test jobs on Python 3.11.13, schema-correct restore/save cache steps, fallback cache keys, test/coverage artifacts, and non-fatal Codecov upload.
• Aligns CI installation with email-service: load the shared KeepSafe SSH key fingerprint, install committed development requirements from the package index and immutable KeepSafe Git source without probing internal pypicloud, then install the package editable without resolving dependencies again. Cache keys include requirements-dev.txt.
• Aligns lxml==6.0.2 with libks==1.0.5, the source of truth for the email-service downstream environment.

Proof run

• python3.11 --version: Python 3.11.13
• Exact editable development install: pass
• Clean CI=1 make ci-dev-install: pass using package-index dependencies and the immutable internal html-structure-diff commit, with no internal pypicloud probe
• make lint: pass
• make test: pass, 65 tests, 1 skipped, coverage total 84%
• CI=1 make test: pass, 65 tests, 1 skipped; writes build/coverage/coverage.xml and build/test/results.xml
• CI=1 make test-only: pass for the exact CircleCI test-job command
• venv/bin/python -m compileall validator tests: pass
• Exact-version import smoke for validator, validator.checks.url, aiohttp==3.13.2, beautifulsoup4==4.15.0, lxml==6.0.2, Markdown==3.10.2, parse==1.22.1, and commit-pinned sdiff==1.1.0: pass
• venv/bin/content-validator --help and venv/bin/content-validator --version: pass
• venv/bin/pip check: pass
• Isolated sdist and wheel build plus metadata pin checks: pass; both artifacts preserve the immutable html-structure-diff commit reference
• Downstream email-service editable integration on CPython 3.11.13: pass with libks==1.0.5, all four internal Python 3.11 worktrees, and lxml==6.0.2; pip check and pipdeptree --warn fail both pass
• circleci config validate .circleci/config.yml: pass
• circleci config process .circleci/config.yml: pass with CircleCI API access; reusable 2.1 config expands into the expected three jobs
• Remote CircleCI on 365b74f: prepare_cache, lint, and test all passed, confirming the immutable internal sdiff reference resolves in the clean CI path
• git diff --check: pass

Known gaps

• Dependency install/build proof requires package-index and GitHub access; sdiff==1.1.0 currently resolves from an immutable internal commit and should move to an index pin after the KeepSafe release is published.
• Email-service editable downstream validation is complete; package publication, generated requirements, and Ansible deployment updates remain follow-up work.
• Service-only python311-service-upgrade-stack tasks remain intentionally skipped because this repo has no Paste/Gunicorn/INI/healthcheck/worker/Docker runtime surface.

Linear

BE-94: Upgrade content-validator to Python 3.11

Fixes BE-94