Adopt the py-canon fleet standard

[soodoku]

Brings fairlex onto py-canon v1.1.1. CI, docs and release now run from the
fleet's reusable workflows; the hand-rolled ci.yml, docs.yml and
python-publish.yml are replaced.

What changed

Layout. fairlex/ -> src/fairlex/, the layout the standard assumes.

Lint. Adopted the canon ruff rule set (43 rule groups, up from 13). 141
findings on the first pass, all resolved rather than silenced except:

Exemption	Why
pep8-naming.extend-ignore-names = ["A", "A_ub"]	A is the membership matrix in the calibration literature this implements; A_ub is scipy.optimize.linprog's own parameter name. Scoped to those two names, not a blanket N drop.
pylint.max-args = 8	The two public entry points take the LP's data plus its bounds and slack. A config object would only move the count.
"docs/**/*.ipynb" = ["T201"]	Printing is how a tutorial notebook produces its rendered output.

No E501 ignore: the long lines in calibration.py and the example notebook
were wrapped. The repo's previous config ignored E501, T201, B008,
PLR0913 and UP037 globally; only the two above survive.

Docstrings. Every docstring was numpy-style while both ruff pydocstyle and
pydoclint were configured for Google. Converted them, which cleared 11 D416
and 6 pydoclint violations.

Docs. docs/conf.py now delegates to py_canon.sphinx.configure, with
three repo-specific additions kept: myst-nb, the numpy/scipy/pandas
intersphinx targets, and the furo source links. nbsphinx was replaced by
myst-nb because nbsphinx shells out to a pandoc binary that the reusable
docs workflow does not install — the build would have failed on the first
run. sphinx-build -W is clean, including the executed notebook.

Retired. mypy (pre-commit hook, Makefile target) and deptry; the
# type: ignore[name-defined] string annotation in _solve_lp is now a real
OptimizeResult import.

Bug fix. The example notebook's "Survey Representativeness" line counted
margins still off target and reported them as biases corrected — it printed
0 demographic biases corrected for a calibration that hit every margin. It
now reports 18 of 18 biased margins brought on target.

Verification

• ruff check / ruff format --check: clean
• pyright: 0 errors
• pydoclint src/: no violations
• preen check --strict: all 22 checks pass
• pytest --cov: 27 passed, 95% coverage; coverage-floor set to 94
• Wheel job simulated locally: builds, twine check passes, tests run against
  the installed wheel
• sphinx-build -W -b html and the doctest builder: both succeed
• zizmor --min-severity high: no findings

uv lock --upgrade was run to clear 10 known vulnerabilities preen's audit
check found in dev/docs transitive dependencies.

Manual steps for you

1. PyPI trusted publisher: repoint the fairlex publisher from
   python-publish.yml to release.yml, environment pypi.
2. Ruleset: the required status check is now the single gate context
   from the reusable CI. Create or repoint it.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[soodoku]

CI status

Everything passes except ci / dependency-review, and ci / gate fails only because it aggregates that job:

Job	Result
lint (ruff, pyright, pydoclint, preen check --strict)	pass
test 3.12 / 3.13 / 3.14	pass
Build and test wheel	pass
workflow-security (zizmor)	pass
docs / build	pass
dependency-review	fail

Dependency review is not supported on this repository.
Please ensure that Dependency graph is enabled

This is a repository setting, not a code problem. finite-sample/calibre — already on py-canon — has a working dependency graph (GET /repos/finite-sample/calibre/dependency-graph/sbom returns an SBOM); fairlex returns 404.

I enabled Dependabot security updates via the API, which normally implies the graph, and it did not take. The dependency graph has no supported REST field for public repos, so it needs a click:

https://github.com/finite-sample/fairlex/settings/security_analysis → Dependency graph → Enable

Then re-run the failed jobs and gate will go green. Note that the org default is off (dependency_graph_enabled_for_new_repositories: false), so every future finite-sample repo will hit this too.