feat: auto-detect dependency changes and reinstall openant

[joshbouncesecurity]

Summary

The Go CLI now hashes pyproject.toml after pip install -e and re-runs install automatically when dependencies change. Prevents stale venv issues after git pull introduces new dependencies.

Addresses item 14 from #16 (does not close the issue).

Test plan

• First run after a fresh checkout installs the venv as before.
• Subsequent runs with unchanged pyproject.toml skip the install.
• Modifying pyproject.toml (e.g., adding a dep) causes the next CLI invocation to reinstall automatically.
• Deleting ~/.openant/venv/.deps-hash and re-running causes a reinstall and recreates the hash.

[joshbouncesecurity]

Manual verification

After installing this branch:

• First run: openant --version triggers initial pip install. Confirm ~/.openant/venv/.deps-hash is created.
• Second run, no changes: openant --version skips install — should be near-instant with no install message.
• Pyproject changed: edit libs/openant-core/pyproject.toml (e.g., add a comment), re-run: prints "Dependencies changed, updating..." and reinstalls.
• Hash file deleted: rm ~/.openant/venv/.deps-hash then re-run: reinstalls and recreates the hash.
• Read-only venv parent: if ~/.openant/venv/ doesn't exist (e.g., custom OPENANT_PYTHON), the helper now MkdirAll's it instead of erroring.

[joshbouncesecurity]

Local test results

Built the Go CLI from this branch on Windows and exercised the deps-hash flow. (Note: I needed OPENANT_PYTHON pointing at Scripts/python.exe because the managed-venv path uses bin/python which is the documented Windows limitation, unrelated to this PR.)

Commands run:

go build -o openant.exe ./
# Hash exists from prior install
ls ~/.openant/venv/.deps-hash      # present, sha256 = f251e66e...

# Delete hash to simulate "first run / hash missing"
rm ~/.openant/venv/.deps-hash
OPENANT_PYTHON=...Scripts/python.exe ./openant.exe parse <fixture>
# -> ran install, recreated .deps-hash

# Run again with hash present and no pyproject change
./openant.exe parse <fixture>
# -> NO install message, jumped straight to parser

Outcome:

• First run / hash missing: install ran, .deps-hash (re)created ✅
• Second run, no changes: skipped install, near-instant ✅
• Pyproject-changed and hash-deleted paths: I tested the hash-deleted path (covers the same code path as pyproject-changed since both produce a hash mismatch). Did not edit pyproject.toml to avoid touching the worktree.
• (n/a) Read-only-venv-parent MkdirAll branch: not exercised — the venv parent already existed.

Sample output of the post-install run for transparency:

Creating managed Python environment at ~/.openant/venv/...
Installing openant from ...libs/openant-core...
[Reachability Filter] ...  -> 5 units written

The .deps-hash was correctly written after the install completed.