v1.0.33

Merge pull request #80 from datacoves/chore/bump-version-github-app-token

chore(ci): mint a GitHub App token for bump-version, drop BOT_TOKEN

Merge pull request #81 from datacoves/chore/remove-unused-reset-test-account-workflow

chore(ci): remove unused reset-test-account workflow

chore(ci): remove unused reset-test-account workflow

It has zero runs in this repo's history. The underlying tooling
(tools/manage_test_account.py, make reset-test-account) is untouched and
stays available for local/manual use, documented in TESTING.md.

chore(ci): mint a GitHub App token for bump-version, drop BOT_TOKEN

datacoves-sa's classic PAT stopped working once the org blocked classic
PATs. A short-lived installation token from a GitHub App scoped to
Contents: read/write replaces it, and still counts as an external actor so
creating the release fires release: published for release-package.yml, same
as before.

Merge pull request #79 from datacoves/fix/tag-masking-policy-reference-missing-database

fix(tag_masking_policy_reference): treat a missing database as not-created-yet

fix(tag_masking_policy_reference): treat a missing database as not-created-yet

Querying .INFORMATION_SCHEMA.POLICY_REFERENCES for a tag's own
database fails with INVALID_IDENTIFIER (2004), not DOES_NOT_EXIST_ERR (2003),
when that database doesn't exist yet -- e.g. a fresh account where the same
config creates the database and declares the masking policy reference in one
plan. This mirrors the existing DOES_NOT_EXIST_ERR handling used for roles.

Merge pull request #78 from GClunies/chore/envrc-uv-sync

chore: manage the package entirely with uv

Merge pull request #71 from jacodegroothydrab/fix/service-user-login-name

Read login_name and display_name back for service users

chore(ci): drop twine; uv build and the wheel-content check cover packaging

chore(release): publish to PyPI with uv publish and drop pip-era tooling

Replace twine upload with uv publish, remove the build dev dependency that
uv build superseded, and drop the egg-info cleanup that only mattered for
pip editable installs. twine stays for the metadata check in CI.

fix(user): read login_name and display_name back for service users

fetch_user discards login_name and display_name for TYPE = SERVICE, so the provider
reports None whatever the account holds. A config declaring either gets a diff that
can never converge: applying it changes nothing, and the next plan proposes it
again.

SHOW USERS reports both for service users. Only must_change_password is genuinely
unreadable for TYPE = SERVICE, so that stays blanked.

It also defeats the point of declaring login_name at all. ALTER USER ... RENAME TO
leaves LOGIN_NAME behind, and a field the provider always reads as None can never
surface that drift.

Adds 6 unit tests over fetch_user, which had none.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com