ci/security/test: automated audit fixes for QuantStrategyPlugins

[Pigbibi]

Summary

• modernize project.license metadata to remove setuptools deprecation warnings during package builds

Problems found

• python -m build emitted a setuptools deprecation warning because project.license used TOML table syntax

Fixes applied

• changed pyproject.toml from table-form license metadata to SPDX string form: license = "MIT"

Security impact

• none; no secrets, permissions, runtime config, or execution logic changed

Architecture impact

• none; packaging metadata only

Tests run

• .venv-audit/bin/ruff check .
• .venv-audit/bin/python -m pytest -q
• .venv-audit/bin/python -m build
• actionlint
• git diff --check

Failed or skipped checks with reasons

• none

Deployment notes

• no deployment required

Rollback plan

• revert commit 1985a51

Manual follow-up checklist

• confirm PR checks pass
• merge after human review / branch protection requirements

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1985a51ad6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bump setuptools floor for SPDX license syntax

When an isolated PEP 517 build is resolved against a constrained index/cache with setuptools 69.x–76.x, this new string form is still allowed by [build-system].requires = ["setuptools>=69", ...] but those setuptools versions do not support PEP 639 SPDX license expressions in project.license (support starts in 77.0.0). That makes package builds fail in environments that legitimately satisfy the declared backend requirement; either keep the table form or raise the setuptools lower bound to >=77.

Useful? React with 👍 / 👎.