ci: replace homebrew-pypi-poet with inline PyPI fetcher

poet (last release 2018) still hits the legacy pypi.io endpoint and
404s on names that don't normalize cleanly through PyPI's redirect.
Replace with a small inline Python script that walks the venv's
installed distributions, queries https://pypi.org/pypi/<name>/json,
picks the sdist file and emits Homebrew resource blocks. Hard-fails
when any package is missing an sdist.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -38,13 +38,58 @@ jobs:
           python -m venv .poet-venv
           . .poet-venv/bin/activate
           pip install --upgrade pip
-          # homebrew-pypi-poet (last released 2018) still imports pkg_resources,
+          pip install .
-          # which setuptools >=81 no longer bundles. Pin to a setuptools that
+          python <<'PY' > resources.rb
-          # still ships it.
+          # Walk every installed package in the venv (excluding pip/setuptools/
-          pip install 'setuptools<70' wheel
+          # wheel and the project itself), fetch sdist URL + sha256 from PyPI,
-          pip install homebrew-pypi-poet .
+          # and emit Homebrew `resource` blocks. Replaces homebrew-pypi-poet,
-          python -c "import pkg_resources; print('pkg_resources OK:', pkg_resources.__file__)"
+          # which is unmaintained (2018) and breaks on modern setuptools and
-          poet dsmview > resources.rb
+          # PyPI URL changes.
+          import json, sys, urllib.request
+          from importlib.metadata import distributions
+
+          SKIP = {"pip", "setuptools", "wheel", "dsmview"}
+
+          def fetch(name: str) -> dict:
+              url = f"https://pypi.org/pypi/{name}/json"
+              with urllib.request.urlopen(url, timeout=20) as r:
+                  return json.load(r)
+
+          def sdist(releases: list) -> dict | None:
+              for f in releases:
+                  if f.get("packagetype") == "sdist":
+                      return f
+              return None
+
+          def block(name: str, version: str, url: str, sha: str) -> str:
+              return (
+                  f'  resource "{name}" do\n'
+                  f'    url "{url}"\n'
+                  f'    sha256 "{sha}"\n'
+                  f'  end\n'
+              )
+
+          packages = sorted(
+              (d.metadata["Name"], d.version)
+              for d in distributions()
+              if d.metadata["Name"].lower() not in SKIP
+          )
+          out = []
+          missing = []
+          for name, version in packages:
+              data = fetch(name)
+              files = data.get("releases", {}).get(version, [])
+              s = sdist(files)
+              if s is None:
+                  print(f"ERROR: no sdist for {name} {version}", file=sys.stderr)
+                  missing.append(f"{name}=={version}")
+                  continue
+              out.append(block(name, version, s["url"], s["digests"]["sha256"]))
+          sys.stdout.write("\n".join(out))
+          if missing:
+              print(f"missing sdists: {missing}", file=sys.stderr)
+              sys.exit(1)
+          PY
           echo "--- resources.rb ---"
           cat resources.rb