feat: add CEP-6 channel notice support

[wolfv]

Description

Add end-to-end support for CEP-6 channel notices.

• add shared ChannelNotice, ChannelNoticeLevel, and ChannelNotices types
• optionally fetch notices.json through the repodata gateway
• return notices on query results and stream them through Reporter::on_channel_notice
• cache notices until their earliest expires_at, retry failures after a bounded interval, and coalesce concurrent fetches
• treat notice failures as non-fatal, isolate malformed entries, filter expired notices, and cap responses at 1 MiB
• publish notices.json from rattler-index configuration for filesystem and S3 channels
• publish notices only after indexing succeeds and honor S3 precondition checks
• expose notice configuration and structured results in the Python and JavaScript bindings
• retain expired_at as a read alias while emitting CEP-6's standard expires_at
• update the source-package build backend to pixi-build-rust 0.5 and exempt that backend from the workspace's seven-day package cutoff; Pixi 0.76 requires build API v6, so source-package CI cannot initialize the older backend

Example rattler-index configuration:

[[index-config.notices]]
id = "security-1"
message = "Please update the affected package"
level = "critical"
created_at = "2025-01-01T12:00:00Z"
expires_at = "2025-02-01T12:00:00Z"

How Has This Been Tested?

• cargo test -p rattler_repodata_gateway --all-features channel_notice
• cargo test -p rattler_index --test test_index test_index_writes_channel_metadata
• cargo clippy -p rattler_repodata_gateway -p rattler_index --all-features -- -D warnings
• cargo check --manifest-path py-rattler/Cargo.toml
• pixi run -m py-rattler/pixi.toml lint-python
• pixi run -m py-rattler/pixi.toml type-check
• pixi run -m py-rattler/pixi.toml test -- tests/unit/test_gateway.py -q
• cargo check --manifest-path js-rattler/Cargo.toml
• npm test -- --runInBand src/Gateway.test.ts
• npx tsc --noEmit
• wasm-pack build --mode normal --debug --target nodejs

Coverage includes local and HTTP channels, query results and reporter callbacks, malformed entries, expiration refresh, request coalescing, response-size limits, indexing output, and Python/JavaScript configuration.

AI Disclosure

• This PR contains AI-generated content.
  • I have tested any AI-generated content in my PR.
  • I take responsibility for any AI-generated content in my PR.

Tools: OpenAI Codex

Prompt:

Can you implement channel notices? I think it should be enabled on the repodata gateway, and if enabled and any notices found returned as part of the reporter, or as part of the result ... or both.

Please also make a follow up commit implementing support to rattler index!

Anything else we should do on this? Can you also do an adversarial review?

OK yes, please do that.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added sufficient tests to cover my changes.

[baszalmstra]

I found three issues:

• Notice requests bypass max_concurrent_requests, so querying many channels can still create unbounded concurrent requests.
• The Python and JavaScript bindings expose a separate channel_notices() method, but query results still discard notices.
• Notices are only fetched for explicitly configured channels. Channels discovered through CEP-42 channel_relations are ignored.

[baszalmstra]

Most of the properties of what to query are on the query itself, not on the gateway. I think it would be much nicer if we can set the with_channel_notices on the gateway.query instead of on the gateway itself.

[wolfv]

Changed that

[github-actions]

cargo-semver-checks detected API breaking changes compared with the pull request's base revision.

Details

    Building rattler_conda_types v0.49.0 (current)
       Built [  24.935s] (current)
     Parsing rattler_conda_types v0.49.0 (current)
      Parsed [   0.090s] (current)
    Building rattler_conda_types v0.49.0 (baseline)
       Built [  24.708s] (baseline)
     Parsing rattler_conda_types v0.49.0 (baseline)
      Parsed [   0.087s] (baseline)
    Checking rattler_conda_types v0.49.0 -> v0.49.0 (assume minor change)
     Checked [   0.497s] 196 checks: 196 pass, 57 skip
     Summary no semver update required
    Finished [  52.189s] rattler_conda_types


--- failure constructible_struct_adds_field: externally-constructible struct adds field ---

Description:
A pub struct constructible with a struct literal has a new pub field. Existing struct literals must be updated to include the new field.
        ref: https://doc.rust-lang.org/reference/expressions/struct-expr.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/constructible_struct_adds_field.ron

Failed in:
  field IndexChannelConfig.notices in /home/runner/work/rattler/rattler/crates/rattler_config/src/config/index.rs:109
    Building rattler_config v0.6.2 (current)
       Built [  25.049s] (current)
     Parsing rattler_config v0.6.2 (current)
      Parsed [   0.020s] (current)
    Building rattler_config v0.6.2 (baseline)
       Built [  25.282s] (baseline)
     Parsing rattler_config v0.6.2 (baseline)
      Parsed [   0.019s] (baseline)
    Checking rattler_config v0.6.2 -> v0.6.2 (assume minor change)
     Checked [   0.136s] 196 checks: 195 pass, 1 fail, 0 warn, 57 skip

     Summary semver requires new major version: 1 major and 0 minor checks failed
    Finished [  52.259s] rattler_config


--- failure constructible_struct_adds_field: externally-constructible struct adds field ---

Description:
A pub struct constructible with a struct literal has a new pub field. Existing struct literals must be updated to include the new field.
        ref: https://doc.rust-lang.org/reference/expressions/struct-expr.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/constructible_struct_adds_field.ron

Failed in:
  field ChannelMetadata.notices in /home/runner/work/rattler/rattler/crates/rattler_index/src/lib.rs:76
    Building rattler_index v0.30.11 (current)
       Built [  88.025s] (current)
     Parsing rattler_index v0.30.11 (current)
      Parsed [   0.031s] (current)
    Building rattler_index v0.30.11 (baseline)
       Built [  86.576s] (baseline)
     Parsing rattler_index v0.30.11 (baseline)
      Parsed [   0.024s] (baseline)
    Checking rattler_index v0.30.11 -> v0.30.11 (assume minor change)
     Checked [   0.075s] 196 checks: 195 pass, 1 fail, 0 warn, 57 skip

     Summary semver requires new major version: 1 major and 0 minor checks failed
    Finished [ 179.462s] rattler_index


--- failure constructible_struct_adds_field: externally-constructible struct adds field ---

Description:
A pub struct constructible with a struct literal has a new pub field. Existing struct literals must be updated to include the new field.
        ref: https://doc.rust-lang.org/reference/expressions/struct-expr.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/constructible_struct_adds_field.ron

Failed in:
  field NamesQueryOutput.notices in /home/runner/work/rattler/rattler/crates/rattler_repodata_gateway/src/gateway/query.rs:79
  field RepoDataQueryOutput.notices in /home/runner/work/rattler/rattler/crates/rattler_repodata_gateway/src/gateway/query.rs:36
    Building rattler_repodata_gateway v0.31.0 (current)
       Built [  65.100s] (current)
     Parsing rattler_repodata_gateway v0.31.0 (current)
      Parsed [   0.058s] (current)
    Building rattler_repodata_gateway v0.31.0 (baseline)
       Built [  63.975s] (baseline)
     Parsing rattler_repodata_gateway v0.31.0 (baseline)
      Parsed [   0.057s] (baseline)
    Checking rattler_repodata_gateway v0.31.0 -> v0.31.0 (assume minor change)
     Checked [   0.150s] 196 checks: 195 pass, 1 fail, 0 warn, 57 skip

     Summary semver requires new major version: 1 major and 0 minor checks failed
    Finished [ 132.635s] rattler_repodata_gateway