chore(rules): port automarket rules and add import-linter/pytest-randomly

[Alberto-Codes]

Convention alignment was inconsistent between automarket and gepa-adk. This ports
the mature quality patterns from automarket and adds declarative architecture
enforcement via import-linter to complement the existing boundary check script.

• Add Claude rules: pr-review-comments, dev-quality-checklist, sonarqube, pytest
• Update python.md with semantic rules (future annotations, no assert in prod, module size guidance)
• Update pull-requests.md with branch naming convention
• Update testing.md with autospec and patch-where-used mocking rules
• Add import-linter with hex layers + forbidden external SDK contracts
• Add pytest-randomly for test order randomization
• Wire lint-imports into pre-commit, CI lint job, and boundaries workflow
• Upgrade transitive deps to fix known vulnerabilities (CairoSVG, pyasn1, PyJWT, pyOpenSSL)

Test: uv run lint-imports && uv run pytest --co -q 2>&1 | grep randomly

---

PR Review

Checklist

• Self-reviewed my code
• Tests pass (uv run pytest)
• Lint passes (uv run ruff check .)
• Breaking changes use ! in title and BREAKING CHANGE: in body

Review Focus

• import-linter contracts in pyproject.toml — verify layer ordering and ignore_imports exceptions match ADR-000
• New Claude rule files — check for gepa-adk-specific accuracy (project key, paths, examples)

Related

• Ported from automarket project conventions
• Complements existing scripts/check_boundaries.sh (can be removed once import-linter is proven in CI)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!