feat: entry-point provider discovery with inline-table local form

[henryiii]

🤖 AI text below 🤖

Adds an entry-point discovery mechanism for dynamic-metadata providers, replacing the import-path + provider-path scheme with a two-shape provider config. Follows up on the "could we provide an entry point system?" design discussion.

What changed

provider now takes one of two shapes:

# installed plugin — a name registered in the `dynamic_metadata.provider` group
provider = "dynamic_metadata.regex"

# local plugin inside the project — inline table (replaces `provider-path`)
provider = { path = "scripts", module = "my_plugin" }   # module may be "mod:Class"

• Installed plugins register a name in the dynamic_metadata.provider entry-point group. Bundled plugins register under dynamic_metadata.-prefixed names; third-party plugins are encouraged to prefix with their own package (the group is shared, and a name registered by two distributions is a hard error).
• Local plugins use the inline { path, module } table. The raw module-path form is only accepted this way — there is no bare-import fallback.
• Unknown names raise with a did you mean …? suggestion.

For each audience

• Plugin authors: hooks unchanged. To get a name, add one [project.entry-points."dynamic_metadata.provider"] table to your own pyproject.toml. Loose in-project scripts still need no packaging (inline table). No runtime dependency on this package either way.
• Backends: no new required API — resolution is internal to the loader; process_dynamic_metadata / load_dynamic_metadata signatures are unchanged. New optional list_providers() for diagnostics.
• Schema: provider is now a oneOf (string, or {path, module} object).

Notable bits

• New _compat.metadata.entry_points shim handles the 3.8/3.9-vs-3.10+ API split without tripping filterwarnings = error.
• list_providers() + dynamic-metadata providers CLI subcommand.
• RESERVED_KEYS shrank to just {provider}.

Testing

uv run pytest (80 passed), mypy --strict, and prek -a all green. New tests cover entry-point resolution (module/class/singleton/import-failure/duplicate), the inline-table form and its validation, rejection of the raw-import form without a path, and the discovery helper + CLI.

Open questions

• Design is still WiP (per the repo). Naming (module key, dynamic_metadata.-prefixed provider names) and the drop of provider-path were chosen in discussion but are easy to revisit.