Add a Europe PMC Bookshelf rung for NCBI book parts

[lgruen-cpg]

Adds a fetcher for NCBI Bookshelf book parts — GeneReviews chapters and the rest of the Bookshelf corpus — and bumps the version to 0.4.0.

A book part has no PMCID, the identifier the PMC rungs key on. Its accession is a Bookshelf id (NBK + digits), which PubMed's own record carries, and Europe PMC serves the full text as BITS XML (JATS's book tag set, root <book-part-wrapper>) under /{bookid}/bookXML, the sibling of the article endpoint. ArticleIds gains bookid; the consumer supplies it from the PubMed record, since no resolver can.

The rung heads the default ladder. A present bookid is decisive — the part has no PMCID for the PMC rungs to find — and costs one GET, so a pmid+bookid bundle is served before any PMC rung or resolver call is spent chasing a PMCID that does not exist. ids.RESOLVABLE names the three identifiers a resolver can supply (pmid, pmcid, doi); fetch_body's demand-driven resolution, chain's stop condition and chain_batch's required all read it, so a rung whose unmet requirement is bookid never triggers the resolver.

A bookXML miss is HTTP 200. The book endpoint answers an unknown id with a <fullTextXMLBean> message envelope rather than the 404 the article endpoint returns. Both Europe PMC fetchers share one GET-and-decline helper; it sniffs the root tag from the first start event, not a full parse, and declines on that envelope.

BITS licence precedence. A book part can carry two <permissions> blocks: the book's in <book-meta> and the part's in <book-part-meta>, with the book's first in document order. _from_jats reads a <book-part-wrapper> from book-part/book-part-meta/permissions first, then book-meta/permissions, and nowhere else — a figure's permissions are not the part's. Any other root keeps the whole-document walk. The real GeneReviews payload (NBK1247) states its licence only at book level, as an open-access-typed link to its usage terms, and extracts under this rule.

__version__ and the HTTP User-Agent are read from the installed distribution's metadata, so the version is stated once, in pyproject.toml.

Where to look. litfetch/fetchers.py (the rung, the shared GET-and-decline helper, the accession gate), litfetch/sessions.py (the RESOLVABLE gate on resolution), litfetch/source_metadata.py (the BITS licence scopes), and the tests alongside each.

Release. After merge, publish GitHub Release v0.4.0 (matching pyproject.toml); the release workflow publishes it to PyPI.

[lgruen-cpg]

import xml.etree.ElementTree as ET — what's the rule about using defusedxml?

The rule as enforced is ruff's S314: parsing goes through defusedxml only, and it does — fromstring in both files, iterparse for the root sniff. The stdlib import in source_metadata.py is for the Element type in annotations, which defusedxml doesn't export (it returns stdlib Elements). The one in fetchers.py was only there for ParseError, which defusedxml re-exports; dropped in 654da15.