fix(validation): use jsonschema[format-nongpl] for the format checkers

[LukasGold]

Closes #121.

Most of formats.py now delegates to jsonschema[format-nongpl]'s checkers. The module stays as the seam, so no caller changes: OOLD_FORMAT_CHECKER, is_iri, is_iri_reference, IRI_FORMATS and FORMAT_SAMPLES are unchanged. 234 lines to 194.

The issue's premise was partly wrong, and the divergences are kept

The issue said the library covers all 18 formats with "identical behaviour on the cases that matter". Checked against tests/data/format_parity.json, the 98-case table already in the repository, and 9 of those cases mismatch across 5 formats. Those 5 stay hand-written, with the reason recorded in the module docstring:

Format	Why the library checker was not taken
date-time, time	rfc3339_validator rejects the space separator, offsets without a colon (+0200), and the leap second 23:59:60, all accepted by the reference toolchain
email, idn-email	the library's checker for both is "@" in instance, far looser than ajv-formats' pattern
uuid	parses via uuid.UUID, which strips a urn:uuid: prefix, then range-checks dash positions assuming no prefix, so a prefixed UUID is wrongly rejected

The uuid one is a genuine library defect rather than a taste difference, and urn:uuid: is a form this package's own fixtures use.

The 13 formats that did match exactly were swapped: date, duration, hostname, idn-hostname, ipv4, ipv6, iri, iri-reference, json-pointer, regex, relative-json-pointer, uri, uri-reference. That includes every row the issue measured, the compact-IRI cases ex:alice and schema:Person among them, and the non-ASCII behaviour asserted by test_iri_allows_non_ascii_but_uri_does_not.

Licence

jsonschema[format-nongpl], never jsonschema[format]. The latter pulls rfc3987, which is GPLv3+, into a package that is Apache-2.0. What format-nongpl does pull: fqdn is MPL-2.0, rfc3986-validator is MIT, rfc3987-syntax is Apache-2.0. MPL-2.0 is file-level copyleft with no obligation on the combined work.

The extra lands on the optional dependency groups (validation, mcp, all, and the dev group), not the core, which is the answer to the 20-transitive-package cost the issue raises.

.github/workflows/main.yml gains an assertion that rfc3987 never appears in uv.lock. The failure mode it catches is the dangerous one precisely because it works: someone types jsonschema[format], the build is green, the tests pass, and the distribution has quietly become GPLv3+. That grep is the only moment anyone would look. It was confirmed to actually fail by running it against a synthetic lock fragment containing rfc3987, not just by observing it pass.

Verification

Rebased onto main at v0.18.3 and re-verified there, since the first run measured against a main that has since moved by five commits:

• tests/test_validation/test_formats.py: 140 passed
• full suite: 565 passed, 9 skipped, unchanged from main
• make check: clean, including deptry and lock consistency
• uv run oold validate tests/data/oold --offline: PASS, 380 ok, 21 warnings, unchanged
• parity against fresh clones of both references: 6 passed
• rfc3987 confirmed absent from uv.lock

The rebase produced no conflicts. #144 also edits .github/workflows/main.yml, but in a disjoint section, so its oold-js parity setup and this branch's rfc3987 assertion both survive. uv.lock was regenerated with uv lock rather than merged by hand and came out byte-identical to the auto-merged result.

[github-actions]

Release preview

Merging this PR would release v0.18.4 (current: v0.18.3).

Changelog preview (truncated)

## v0.18.4 (2026-08-31)

### Bug Fixes

- **validation**: Use jsonschema[format-nongpl] for format checks
  ([`51043c1`](https://github.com/OO-LD/oold-python/commit/51043c1dcd6e3416b32899f6914b78b78bad69e6))

### Testing

- **parity**: Compare against oold-js instead of oold-schema's scripts
  ([#144](https://github.com/OO-LD/oold-python/pull/144),
  [`42d0d74`](https://github.com/OO-LD/oold-python/commit/42d0d740fec4285ca6c3b9bd9c0c028a9368b601))

_{Preview via python-semantic-release and conventional commits.}

[github-actions]

📊 Benchmark Results

Click to see benchmark comparison

📊 Benchmark Comparison (threshold: 1.3x)
============================================================

➖ Unchanged (within threshold):
  ➖ test_simple_dict_document_store: 0.0016s → 0.0016s (-0.1%)
  ➖ test_sqlite_document_store: 0.0017s → 0.0017s (+0.0%)
  ➖ test_local_sparql_store: 0.0391s → 0.0388s (-0.7%)
  ➖ test_oneof_subschema: 0.0583s → 0.0592s (+1.5%)
  ➖ test_enum_docstrings: 0.0528s → 0.0498s (-5.7%)
  ➖ test_subclass_inheritance: 0.0515s → 0.0530s (+3.0%)
  ➖ test_class_hierarchy: 0.0484s → 0.0491s (+1.4%)
  ➖ test_core[v1]: 0.0364s → 0.0368s (+1.0%)
  ➖ test_core[v2]: 0.0416s → 0.0415s (-0.3%)
  ➖ test_schema_generation[v1]: 0.0015s → 0.0015s (-0.6%)
  ➖ test_schema_generation[v2]: 0.0026s → 0.0026s (+0.5%)
  ➖ test_simple_json: 0.0006s → 0.0006s (+1.0%)
  ➖ test_complex_graph: 0.0015s → 0.0015s (+3.8%)

============================================================
Summary: 0 regressions, 0 improvements, 13 unchanged
============================================================

✅ No significant performance regressions

Threshold: 1.3x (30% slower triggers a regression warning)

Note: Benchmarks are informational only and won't fail the build.

_{💡 Tip: Download the benchmark-results artifact for detailed JSON data}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

📊 Benchmark Results

Click to see benchmark comparison

📊 Benchmark Comparison (threshold: 1.3x)
============================================================

➖ Unchanged (within threshold):
  ➖ test_simple_dict_document_store: 0.0017s → 0.0017s (-0.0%)
  ➖ test_sqlite_document_store: 0.0019s → 0.0019s (+0.5%)
  ➖ test_local_sparql_store: 0.0380s → 0.0390s (+2.7%)
  ➖ test_oneof_subschema: 0.0585s → 0.0590s (+0.9%)
  ➖ test_enum_docstrings: 0.0494s → 0.0500s (+1.2%)
  ➖ test_subclass_inheritance: 0.0533s → 0.0536s (+0.5%)
  ➖ test_class_hierarchy: 0.0506s → 0.0518s (+2.4%)
  ➖ test_core[v1]: 0.0378s → 0.0395s (+4.5%)
  ➖ test_core[v2]: 0.0444s → 0.0449s (+1.1%)
  ➖ test_schema_generation[v1]: 0.0017s → 0.0017s (+2.9%)
  ➖ test_schema_generation[v2]: 0.0029s → 0.0029s (+0.2%)
  ➖ test_simple_json: 0.0007s → 0.0007s (-7.5%)
  ➖ test_complex_graph: 0.0018s → 0.0016s (-8.0%)

============================================================
Summary: 0 regressions, 0 improvements, 13 unchanged
============================================================

✅ No significant performance regressions

Threshold: 1.3x (30% slower triggers a regression warning)

Note: Benchmarks are informational only and won't fail the build.

_{💡 Tip: Download the benchmark-results artifact for detailed JSON data}