Add PEP 723 inline-script setup CodeLens and bulk command (PEP 723 PR 11-12)

[Stella Huang (StellaHuang95)]

Part of #1602. Design doc: #1601.

Roadmap context

This implements the two PEP 723 Phase 4 (UX) PRs together, since they share one setup pipeline:

• PR 11 — CodeLens: Set up environment for this script
• PR 12 — Bulk command: Set Up Environments for Inline Script Files

Everything is gated behind the internal, undeclared python-envs.inlineScripts.enabled flag (default off, latched at activation) and, per the roadmap, nothing is contributed in package.json — the commands are registered programmatically (hidden, like python-envs.clearScriptEnvCache) and the CodeLens provider is only registered when the flag is on. With the flag off (every user today), there is no behavior change.

What this adds

• CodeLens (PR 11): a single "Set up environment for this script" lens anchored to a .py file's # /// script block, shown only when the file has saved PEP 723 metadata that is not currently backed by a validated inline-script environment. It hides once setup completes and reappears if a later metadata change invalidates the association.
• Bulk command (PR 12): scans the workspace for .py files (excluding .venv/node_modules, capped), keeps those that declare a # /// script block, offers a multi-select quick pick (already-configured scripts shown but not pre-checked), and runs setup for each selection.
• Shared setUpInlineScriptEnvironment helper: reuses the pipeline earlier PRs already built — InlineScriptEnvManager.create (select/uv-install a compatible base, build the cached venv, install deps) followed by setEnvironment (register the exact script project (PR 10), persist the association (PR 7), and publish the per-file change so routing (PR 9) picks it up).

Behavior / safety notes

• The CodeLens is a pure observer of InlineScriptRoutingRegistry (getMetadata + shouldRoute); it also returns [] for a dirty document (the manager validates against the saved file).
• Setup captures the script's metadata identity before create and skips associating if it changed during the build, so a slow setup can't overwrite a newer one.
• isLocalPythonFile / extension checks are case-insensitive where it matters; bulk setup runs sequentially (avoids overlapping modal uv prompts) and is idempotent (cache reuse).
• The single-file and bulk entry points surface a message if the inline-script manager isn't available.

Testing

• tsc -p . --noEmit, eslint, and Prettier: clean.
• New unit tests (src/test/features/inlineScript/codeLens.unit.test.ts, setupEnvironment.unit.test.ts) cover CodeLens visibility (no metadata / metadata-but-unrouteable / routeable / dirty), the create→set helper (including the metadata-changed-during-create guard), and the bulk filter/selection/loop.
• Full unit suite green (npm run unittest): 1969 passing.

Scope

UX only; no change to the parsing/manager/routing internals and no package.json contributions. The bulk command is implemented but intentionally has no palette entry yet — exposing these surfaces to users is a later, deliberate step.

[Rich Chiodo (rchiodo)]

🔒 Automated review in progress — Rich Chiodo (@rchiodo) is auto-reviewing this PR.

[Rich Chiodo (rchiodo)]

Review center is taking too long. Looks fine to me.

[Rich Chiodo (rchiodo)]

Warning · Non-blocking recommendation

For bulk-selected scripts that have not been observed by the routing registry, can getMetadataIdentity be undefined both before and after create? If so, saving changed metadata while setup runs bypasses this guard and associates an environment built from stale metadata. Preserve the discovered identity or re-read metadata before associating, and cover this unopened-file race.

[Rich Chiodo (rchiodo)]

Warning · Non-blocking recommendation

This test can pass solely because setMetadata fires the counter, even if routeability changes never refresh CodeLens. Reset the counter after setting metadata, then assert that setValidatedAssociation independently fires the event.

[Rich Chiodo (rchiodo)]

Result: 🔴 could-not-verify

Verification details

Verification: Isolated verification observed failures that were not classified as caused by this PR: Repository test-discovery preflight. The relevant tests could not be fully run in the isolated environment; this review is not fully verified.

Summary: Verification could not run because the container lacked a usable repository checkout and `npm`. The targeted command `npm run compile-tests && npm run unittest -- --grep ...` stopped with `npm: not found`, so none of the 11 added tests executed. Coverage inspection found the configured-script preselection behavior untested. Confidence is limited to static test inventory.

Test runs: 1 failed, 1 not run

• ⚠️ Not run | Inline-script UX unit suites | npm run compile-tests && npm run unittest -- --grep "Inline script CodeLens provider|setUpInlineScript"
• ❌ Failed | unrelated to this PR | Repository test-discovery preflight | printf '%s\n' '--- refs ---' && git branch --show-current && git branch -a --no-color && printf '%s\n' '--- changed files ---' && BASE=$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main) && echo "$BASE" && git diff --name-status "$BASE"...HEAD && printf '%s\n' '--- dependencies ---' && if [ -d node_modules ]; then echo 'node_modules=present'; else echo 'node_modules=missing'; fi && node -e "const p=require('./package.json'); console.log(JSON.stringify(p.scripts,null,2))"

⚠️ Inline-script UX unit suites diagnostic output

/bin/sh: 1: npm: not found

❌ Repository test-discovery preflight diagnostic output

fatal: not a git repository (or any parent up to mount point /)
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).