0.7.26 — Bug fixes + coverage gate + CI hardening

What's new

Bug fixes

• climate: Skip set_temperature when hvac_mode=AUTO — Bosch rejects setpoint writes in AUTOMATIC (schedule) mode. Previously caused silent HTTP 400.
• number: Guard step_size=None in native_step — was TypeError when a device reports no step.
• entity: Fix async_get_device_id return type annotation (None → str | None).
• binary_sensor: SmokeDetectorSensor and SmokeDetectionSystemSensor now unsubscribe their service callback in async_will_remove_from_hass; guard ValueError/KeyError in _input_events_handler.
• event: MotionDetectorEvent dedup guard (_last_fired_timestamp) suppresses phantom motion events on unrelated long-poll updates (battery polls, etc.); SmokeDetectionSystemEvent and SmokeDetectorEvent guard enum errors.
• switch: SHCUserDefinedStateSwitch.available property added — was missing (used HA default True even after the UDS was deleted from the SHC).

CI / test quality

• Coverage gate ≥ 95 % added to tests.yml (current: 99.28 %, 20/22 files at 100 %). Catches regressions automatically.
• All GitHub Actions SHA-pinned for supply-chain hardening; Python 3.12 dropped (HA ≥ 2025.2 requires Python ≥ 3.13); mypy (informational) added.
• dependabot.yml — pip ecosystem entry added for weekly dependency alerts.
• 2939 unit tests total.
• Dependabot PR #350 applied inline (homeassistant test floor bumped to ≥ 2026.6.4).

Library (boschshcpy 0.3.20)

• session.py: list() copies on _subscribers and _userdefinedstate_callbacks during poll-result iteration — prevents RuntimeError: Set changed size during iteration when a callback unsubscribes mid-loop.
• ruff check + format gates added; codebase auto-formatted.

Housekeeping

• Issues #340 (color-temp swapped — fixed in 0.7.9), #342 (SWD2 button — Bosch API limitation), and #345 (coroutine error — fixed in 0.7.22) documented and closed.
• Dependabot PR #350 closed inline.