chore: release 0.21.27 + move ledger-solana to an optional [solana] extra

[OjusWiZard]

Proposed changes

open-aea-ledger-solana sat in open-autonomy's top-level dependency table, so every install pulled solana<0.34.0, which caps websockets<12.0. That cap cannot co-resolve with any modern-websockets consumer — google-genai>=1.0 requires websockets>=13.0 — so downstream builds failed with ResolutionImpossible, or the less obvious resolution-too-deep on pip>=26.2, even for services that never touch Solana.

This moves the plugin to an optional [solana] extra, deliberately excluded from [all].

Two facts made this the right shape:

• Only packages/valory/contracts/squads_multisig imports the plugin, reached solely from skills/squads_transaction_settlement_abci, skills/test_solana_tx_abci and agents/solana_transfer_agent. Nothing under autonomy/ imports it, so it was never a framework-level requirement.
• The [all] exclusion is load-bearing: open-aea-test-autonomy pins open-autonomy[all,docker], which would otherwise reimpose the cap on every downstream test environment. Same rationale that already keeps [hwi] and [docker] out of [all].

Solana users install open-autonomy[solana]. The dev environment is unaffected — make new_env runs poetry install --all-extras, so the repo's own Solana tests keep their plugin (poetry.lock still resolves websockets 11.0.3 for dev).

Also cuts release 0.21.27, bumping the version across all eight pin sites. Two of those were missed by the 0.21.26 release and needed follow-up commits afterwards — the assertion in tests/test_base.py (db5690f3e) and the open-aea-test-autonomy pin in transaction_settlement_abci/skill.yaml (26e8966b7). Both are covered here. That YAML pin cascades through autonomy packages lock into eight dependent package hashes and on into docs/package_list.md; abstract_round_abci is untouched, so ABSTRACT_ROUND_ABCI_SKILL_WITH_HASH in autonomy/constants.py stays in sync.

Fixes

Fixes #2541.

Types of changes

• Non-breaking fix (non-breaking change which fixes an issue)
• Breaking fix (breaking change which fixes an issue)
• Non-breaking feature (non-breaking change which adds functionality)
• Breaking feature (breaking change which adds functionality)
• Refactor (non-breaking change which changes implementation)
• Messy (mixture of the above - requires explanation!)

Breaking only for consumers that actually use the Solana packages — they must switch to open-autonomy[solana] (or [all,solana]). For everyone else this is strictly unblocking. Documented in docs/upgrading.md. Note the precedent — the identical [hwi] extraction in 0.21.18 shipped as a patch release — so 0.21.27 follows that, but flagging it in case a minor bump is preferred.

Checklist

• I have read the CONTRIBUTING doc
• I am making a pull request against the main branch (left side). Also you should start your branch off our main.
• Lint and unit tests pass locally with my changes — with one pre-existing exception, see below
• I have added tests that prove my fix is effective or that my feature works
• I have locally run AI agents that could be impacted and they do not present failures derived from my changes
• Public-facing documentation has been updated with the changes affected by this PR.
• Any backwards-incompatible/breaking change has been clearly documented in the upgrading document.

One box left deliberately unticked — AI agents not run locally: no runtime behaviour changed, and the dev environment resolves identically (poetry install --all-extras still installs the plugin, so the repo's Solana packages are exercised as before).

Review feedback addressed

All five review comments are applied in a303566ef:

1. P1 — corrected the stale "setup.py is authoritative" comment that contradicted this diff. Note the nuance: setup.py is not dead, make install still invokes it; it is simply off the publishing path. The comment now draws that distinction.
2. Wrapped the aea_ledger_solana import in squads_multisig/contract.py, so a missing plugin now raises ImportError: The Solana ledger plugin is required by the squads_multisig contract … pip install open-autonomy[solana] instead of a bare ModuleNotFoundError.
3. Reworded the note beside open-aea-ledger-cosmos — "belongs here too" read as an invitation to move it back.
4. Added a !!! warning callout inside the 0.21.20 section, so deep-linked readers see it (admonition is enabled in mkdocs.yml, so it renders).
5. Added test_solana_plugin_stays_an_opt_in_extra, asserting the plugin is optional, in [solana], and not in [all].

The new guard was mutation-tested rather than merely observed passing — folding the plugin into [all], and dropping optional = true, each fail with a message naming the consequence.

Further comments

Verification

Built the wheel from this branch and ran the reproducer from the issue:

Scenario	Result
Published 0.21.26 + google-genai==1.17.0	ResolutionImpossible — reproduced
This branch's wheel + google-genai==1.17.0	resolves, exit 0
[all,docker] + google-genai==1.17.0	clean — cap does not sneak back via the test-plugin pin
[solana]	open-aea-ledger-solana 2.2.9 / solana 0.33.0 / websockets 11.0.3 — unchanged for Solana users
bare install	solana absent, websockets free to float to 15.0.1

Confirmed the change actually ships: release.yml runs make dist → python -m build → PEP 517 → poetry-core, so pyproject.toml is authoritative for the published wheel.

Passing locally: check-hash, check-packages, check-dependencies, check-api-docs, check-doc-links-hashes, check-abciapp-specs, check-abci-docstrings, black-check, isort-check, flake8, mypy, pylint, bandit, liccheck, fix-copyright, poetry check --lock, and tests/test_base.py (59 passed).

Pre-existing failure, not from this branch

darglint crashes with 'FunctionDescription' object has no attribute 'docstring' on Python 3.14. I checked out clean main (605cee976) in a scratch worktree and it fails identically there, so it is already on main rather than introduced here. Worth a separate issue.

Why not bump solana upstream instead

That remains the better long-term fix, but it is not available yet and is not a one-line widening. open-aea-ledger-solana currently allows solana<0.34.0; solana 0.34.x and 0.35.0 still pin websockets<12.0. The first release accepting websockets>=13 is 0.36.2, and it also moves solders from <0.22 to >=0.23. That needs an open-aea change plus a release before this repo can consume it, whereas this PR unblocks downstreams now. The comment in pyproject.toml flags the revisit condition.

Unrelated diff noise

poetry lock also corrected open-aea-test-autonomy 0.21.25 → 0.21.26 in poetry.lock — pre-existing staleness against that plugin's own setup.py, surfaced by the re-lock rather than caused by it.

Separate cleanup worth filing

setup.py is dead metadata. It omits open-aea-ledger-solana entirely and puts open-aea-cli-ipfs in install_requires, yet the published 0.21.26 metadata matches pyproject.toml exactly on all 18 entries — because the build goes through poetry-core. The comment at the top of pyproject.toml's dependency table still claims setup.py is "the authoritative manifest used for the published wheel", which is backwards and would send the next person fixing a dependency bug to a file that ships nothing. Left out of scope here.