chore: upgrade c7n-left to 0.3.37, pin dev Python to 3.12

[jtroup]

(https://stacklet.atlassian.net/browse/ENG-8243)

what

Upgrade c7n-left to 0.3.37 and realign the pinned botocore /
boto3 versions (1.43.3) to the ones c7n uses, with the
corresponding uv.lock churn.

Alongside the upgrade:

• Add a .python-version pinning the development interpreter to
  3.12, matching the existing .tool-versions (python 3.12.10).
• Fix duplicate Click parameter registration in the run command
  wrapper: LeftWrapper.make_parser now skips params it has
  already appended, and copies each param before tweaking its
  required flag so c7n-left's own command objects aren't mutated.
• Filter the upstream c7n datetime.utcnow() deprecation warning
  from the test run via filterwarnings, leaving the suite clean.
• Ignore editor backup files (*~) in .gitignore.

why

This is part of the ongoing c7n upgrade cohort; the botocore /
boto3 pins are kept exact to match c7n for compatibility.

The .python-version pin is a development-environment fix, not a
consumer constraint: a transitive dependency (test-results-parser,
pulled in by codecov-cli) ships no CPython 3.14 wheels, and its
sdist fails to build on 3.14 because pyo3 0.22 maxes out at 3.13.
uv does not read .tool-versions, so without a .python-version it
would resolve to the newest interpreter on the host (3.14) and fail
the build; pinning to 3.12 keeps uv aligned with the .tool-versions
pin the CI lint job already uses. It does not narrow the published
package's requires-python, so downstream consumers are unaffected.

make_parser runs on every invocation of the module-level
singleton run command and was appending c7n-left's params each
time. The second invocation onward registered every option twice,
so Click emitted a "parameter used more than once" warning per
option. Deduplicating by name before appending removes that noise.

testing

Relying on CI.

docs

Release notes added to NEWS.md. No user-facing docs or runbook
changes needed.

---

🤖 Generated with Claude Code

[kevin-birkett]

Thanks @jtroup

[greptile-apps]

Greptile Summary

This PR upgrades c7n-left from 0.3.36 to 0.3.37 and realigns boto3/botocore pins to 1.43.3 to track c7n's own pinned versions, bumping the package to v0.5.37. Three quality-of-life fixes accompany the dependency bump.

• Duplicate param fix: LeftWrapper.make_parser now short-circuits on already-registered params and copy.copy()s each param before mutating required, so c7n-left's singleton command object is no longer mutated across invocations.
• Dev tooling: A .python-version file pins the development interpreter to Python 3.12 (matching .tool-versions) to prevent uv from picking up CPython 3.14 where test-results-parser wheels are unavailable.
• Test hygiene: filterwarnings in pyproject.toml silences the upstream datetime.utcnow() deprecation from c7n during the test run.

Confidence Score: 5/5

Safe to merge — all changes are narrowly scoped dependency bumps and targeted fixes with no behavioural regressions.

The dependency upgrades are pinned to exact versions already validated by c7n upstream. The make_parser fix correctly deduplicates params and isolates mutations via copy.copy(), fully resolving the previously flagged singleton-mutation concern. The .python-version pin and filterwarnings addition are dev-only with no impact on published package consumers.

No files require special attention.

Important Files Changed

Filename	Overview
stacklet/client/sinistral/commands/run.py	Adds deduplication guard and copy.copy() in make_parser to prevent double-registration and upstream singleton mutation; logic is correct and addresses the previously flagged concern.
pyproject.toml	Bumps c7n-left to 0.3.37, boto3/botocore to 1.43.3, version to 0.5.37, and adds filterwarnings to suppress the upstream c7n utcnow() deprecation in tests.
.python-version	New file pinning the uv-resolved Python to 3.12; well-commented with the rationale about pyo3 0.22 / test-results-parser incompatibility on 3.14.
.gitignore	Adds *~ to ignore editor backup files; trivial and correct.
NEWS.md	Adds v0.5.37 release notes documenting the dependency upgrade, duplicate CLI option fix, and developer tooling changes.

Sequence Diagram

sequenceDiagram
    participant CLI as Click CLI
    participant LW as LeftWrapper.make_parser
    participant LP as left_run.params (c7n-left singleton)
    participant SP as self.params

    CLI->>LW: make_parser(ctx) [invocation 1]
    LW->>SP: "build existing = {param.name for param in self.params}"
    Note over SP: existing = {"project", "dryrun"}
    loop for each param in left_run.params
        LW->>LW: param.name in existing? No
        LW->>LP: copy.copy(param)
        Note over LP: original untouched
        LW->>SP: append copied param (with required tweaks)
    end
    LW->>CLI: super().make_parser(ctx)

    CLI->>LW: make_parser(ctx) [invocation 2+]
    LW->>SP: "build existing = {param.name for param in self.params}"
    Note over SP: existing now includes all left_run params
    loop for each param in left_run.params
        LW->>LW: param.name in existing? Yes - skip
    end
    LW->>CLI: super().make_parser(ctx)

Loading

_{Reviews (2): Last reviewed commit: "chore: upgrade c7n-left to 0.3.37, pin d..." | Re-trigger Greptile}

[kevin-birkett]

thanks @jtroup