fix(release): resolve an interpreter that has tomllib

`./scripts/release.sh prepare minor` fails outright on macOS:

    ModuleNotFoundError: No module named 'tomllib'

tomllib is stdlib only from 3.11, and `python3` on macOS is 3.9. Every helper
in the script -- get_version, get_pkg_name, set_version, bump_version, the
changelog update, and the publish-time changelog check -- hardcoded `python3`,
so releasing this package was impossible on such a machine. The error names a
missing module, which reads as a broken checkout rather than a too-old
interpreter.

Resolved once at load time instead of per call site: `python3` when it can
actually import tomllib, else `uv run`, else a message that says what is
needed and what was found. uv is the right fallback because this repo already
builds and tests through it, so a machine that can run the suite can run the
release.

The two `need python3` guards are dropped as redundant -- resolve_python has
already exited with a better message by then.

Verified under bash, which is how the script runs:

    PY_BIN=uv run --no-project --python 3.12 python
    version=0.10.0   pkg=hotdata-framework
    minor=0.11.0     patch=0.10.1        major=1.0.0

and with no usable interpreter on PATH:

    error: need python3 >= 3.11 (for tomllib) or uv; python3 is Python 3.9.6

No behaviour change to what a release does -- only which interpreter runs it.

Note the same hardcoded `python3 - <<PY` + tomllib pattern is in sdk-python's
and hotdata-marimo's copies of this script, so both are latently broken the
same way on a pre-3.11 `python3`. Not touched here.

Author: anoop-narang

scripts/release.sh

@@ -7,6 +7,25 @@ cd "$ROOT"
 die() { echo "error: $*" >&2; exit 1; }
 need() { command -v "$1" >/dev/null 2>&1 || die "$1 is required"; }
 
+# An interpreter that can `import tomllib` — stdlib only from 3.11, while
+# `python3` on macOS is still 3.9. Hardcoding `python3` made every step below
+# fail with a bare ModuleNotFoundError, which reads as a broken checkout rather
+# than a too-old interpreter, and it failed at the FIRST step so nothing was
+# half-done. Resolved once here rather than per call site.
+#
+# `uv` is the fallback because this repo already builds and tests through it, so
+# a machine that can run the suite can run the release.
+resolve_python() {
+  if command -v python3 >/dev/null 2>&1 && python3 -c "import tomllib" >/dev/null 2>&1; then
+    echo python3
+  elif command -v uv >/dev/null 2>&1; then
+    echo "uv run --no-project --python 3.12 python"
+  else
+    die "need python3 >= 3.11 (for tomllib) or uv; python3 is $(python3 -V 2>&1 || echo absent)"
+  fi
+}
+PY_BIN="$(resolve_python)"
+
 usage() {
   cat <<'EOF'
 Usage:
@@ -24,15 +43,15 @@ EOF
 }
 
 get_version() {
-  python3 - <<'PY'
+  $PY_BIN - <<'PY'
 import tomllib
 from pathlib import Path
 print(tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"])
 PY
 }
 
 get_pkg_name() {
-  python3 - <<'PY'
+  $PY_BIN - <<'PY'
 import tomllib
 from pathlib import Path
 print(tomllib.loads(Path("pyproject.toml").read_text())["project"]["name"])
@@ -41,7 +60,7 @@ PY
 
 set_version() {
   local ver="$1"
-  python3 - "$ver" <<'PY'
+  $PY_BIN - "$ver" <<'PY'
 import re, sys
 from pathlib import Path
 ver = sys.argv[1]
@@ -56,7 +75,7 @@ PY
 
 bump_version() {
   local kind="$1" current="$2"
-  python3 - "$kind" "$current" <<'PY'
+  $PY_BIN - "$kind" "$current" <<'PY'
 import re, sys
 kind, current = sys.argv[1], sys.argv[2]
 match = re.match(r"^(\d+)\.(\d+)\.(\d+)(.*)$", current)
@@ -95,14 +114,13 @@ update_changelog() {
   local ver="$1"
   local date
   date="$(date +%Y-%m-%d)"
-  python3 scripts/update_changelog.py "$ver" "$date"
+  $PY_BIN scripts/update_changelog.py "$ver" "$date"
 }
 
 cmd_prepare() {
   local bump="${1:-}"
   [[ -n "$bump" ]] || { usage; die "missing bump kind or explicit version"; }
   need gh
-  need python3
   ensure_clean
 
   local current new base branch pkg
@@ -151,7 +169,6 @@ After merge, run \`./scripts/release.sh publish\` from a clean \`${base}\` check
 
 cmd_publish() {
   need gh
-  need python3
   ensure_clean
 
   local base ver tag
@@ -166,7 +183,7 @@ cmd_publish() {
 
   git rev-parse "$tag" >/dev/null 2>&1 && die "tag $tag already exists"
   [[ -f CHANGELOG.md ]] || die "CHANGELOG.md is required"
-  python3 - "$ver" <<'PY'
+  $PY_BIN - "$ver" <<'PY'
 import re, sys
 from pathlib import Path
 ver = sys.argv[1]