fix(deps): make installs without dev dependencies work

CHANGELOG.md

@@ -568,6 +568,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Installs without the development dependencies work again (`uv tool install`
+  from a checkout, and any install from a built wheel). Two things broke
+  them: `tree-sitter-language-pack` 1.6.3, the newest release the old
+  `<1.8` cap allowed, installs without an importable module, so every audit
+  crashed while loading controls; and `packaging`, which darnit-core imports
+  directly and through `celpy.c7nlib`, was not declared (#441), so every
+  control with an `expr` was `ERROR`. The cap is now `<1.6.3` and `packaging`
+  is a declared dependency.
 - An audit evaluates only its own framework's controls. A long-lived process
   such as the MCP server used to evaluate every control an earlier audit had
   registered, so auditing `reproducibility` after `openssf-baseline` returned

CLAUDE.md

@@ -386,7 +386,7 @@ else:
 ## Active Technologies
 - Python 3.11/3.12 (workspace targets) plus bash for release scripts and GitHub Actions YAML + `shiv` (binary builder), `cosign` (image + binary signing), `syft` (SBOM generation), `docker buildx` (multi-arch images), `gh` CLI (release creation), Sigstore-action (PyPI wheel signing via `pypa/gh-action-pypi-publish`). No new runtime dependencies in any darnit Python package. (012-packaging-distribution)
 - External release surfaces only — PyPI, TestPyPI, GHCR, GitHub Releases (binary assets + attestations), `kusari-oss/homebrew-tap` repo (formula). Repo itself stores only build configs and workflow definitions. (012-packaging-distribution)
-- Python 3.11/3.12 (workspace targets — same as the rest of darnit) + `pydantic >= 2.0` (already used for `FrameworkConfig`); `packaging` for PEP 440 `SpecifierSet` (declared by `darnit-reproducibility` as of feature 037; darnit-core imports it at runtime without declaring it, which is tracked separately). `tomllib` from stdlib for TOML parsing. No new runtime dependencies. (013-plugin-composition)
+- Python 3.11/3.12 (workspace targets — same as the rest of darnit) + `pydantic >= 2.0` (already used for `FrameworkConfig`); `packaging` for PEP 440 `SpecifierSet` (declared by `darnit-core` and, as of feature 037, by `darnit-reproducibility`). `tomllib` from stdlib for TOML parsing. No new runtime dependencies. (013-plugin-composition)
 - Filesystem only. Composition is resolved in-memory at framework-config load time; no new persistent state. (013-plugin-composition)
 - Python 3.11/3.12 (workspace targets) + `tomllib` (stdlib), `pydantic >= 2` (existing; `extra="forbid"` for the new models). No new runtime dependencies: per-user config location extends the existing `darnit/stores/defaults/platform_paths.py`; repository-identity normalization is a small in-tree helper. (040-operator-config-trust)
 - Filesystem only. Operator configuration: one TOML file per user (research R1). Confirmations: a file under the existing darnit data root, keyed by canonical repository identity (research R6). Project assertions: `.project/darnit.yaml` in the audited repository (read-only input). (040-operator-config-trust)

packages/darnit-baseline/pyproject.toml

@@ -29,7 +29,9 @@ dependencies = [
     #      separate parse_bytes() for the old contract.
     #   2. tree.root_node became a callable method instead of a property.
     # Cap at <1.8 until darnit's parsing layer supports both shapes. See #268.
-    "tree-sitter-language-pack>=1.5,<1.8",
+    # 1.6.3 installs without an importable tree_sitter_language_pack module
+    # (seen on Linux x86_64, Python 3.12), so stop below it too.
+    "tree-sitter-language-pack>=1.5,<1.6.3",
 ]
 
 [project.urls]

packages/darnit/pyproject.toml

@@ -32,6 +32,10 @@ dependencies = [
     "ruamel.yaml>=0.18.0",  # For .project/ round-trip YAML parsing
     "jinja2>=3.1.0",  # Template rendering for remediation files
     "cel-python>=0.5.0",  # CEL expression evaluation for pass logic
+    # PEP 440 version constraints in core/composition.py and
+    # config/framework_schema.py. celpy.c7nlib imports it too, and cel-python
+    # does not declare it.
+    "packaging>=23.0",
     "tomli>=2.0.0;python_version<'3.11'",
     "tomllib-stubs>=0.1.0;python_version<'3.11'",
     # RFC-0001 Stage 1 (feature 025): default LLMStep implementation. Required

packages/darnit/src/darnit/config/framework_schema.py

@@ -1398,8 +1398,8 @@ def _validate_version_constraint_syntax(cls, v: str | None) -> str | None:
         if v is None:
             return v
         try:
-            # Imported lazily; `packaging` is a transitive dep via setuptools
-            # and is already part of every Python install with pip available.
+            # Imported lazily; `packaging` is a declared dependency of
+            # darnit-core (see packages/darnit/pyproject.toml).
             from packaging.specifiers import SpecifierSet
 
             SpecifierSet(v)