Upgrade to Python 3.11

[olmos-keepsafe]

Key changes

• Migrates the package from setup.py/setup.cfg to pyproject.toml, targets Python 3.11.13, and advances the Python 3.11 release line from 0.3.2 to 1.0.1.
• Pins the latest observed compatible runtime and development dependencies, including beautifulsoup4==4.15.0, Markdown==3.10.2, inlinestyler==0.2.5, lxml==6.0.2, parse==1.22.1, pystache==0.6.8, and coverage==7.15.2.
• Retains cssutils==2.11.1 as the latest safe pin after proving 2.13.0, 2.14.0, and 2.15.0 fail to import through the missing encutils module.
• Keeps lxml==6.0.2 compatible with the current downstream email-service lock, which resolves libks==1.0.12 and ks-email-parser==1.0.1 together.
• Modernizes Markdown extension registration for Markdown 3 while preserving legacy Markdown 2 rendering for whitespace-adjacent, multiline, nested, and otherwise malformed strong-emphasis input used by existing templates.
• Removes boundary LRM/RLM characters from rendered link destinations without decoding or altering reserved percent-encoded URL components.
• Preserves CSS-inlined paragraph attributes, encoded image URL semantics, no-tracking links, and historical fixture output under Beautiful Soup 4, inlinestyler 0.2.5, and lxml 6.
• Adds a narrow CSSSelector.evaluate compatibility alias for inlinestyler's legacy lxml selector calls.
• Modernizes CLI asyncio execution and package-version lookup, and makes empty or missing render trees fail instead of silently exiting successfully.
• Removes the unused email_parser.link_shortener prototype rather than retaining an undeclared direct requests dependency; no package, CLI, test, or known downstream call site used it.
• Replaces nosetests with pynose, moves Flake8 configuration into pyproject.toml, and removes pyupgrade after completing the one-time Python 3.6-through-3.11 migration ladder.
• Confirms this package has no direct or transitive msgpack dependency or imports, and adds the shared fail-closed make check-msgpack source scan to make lint.
• Adds valid CircleCI 2.1 package CI using cimg/python:3.11.13, prepare_cache, lint, and test jobs, exact v5 virtualenv cache keys, coverage/test artifacts, and non-fatal Codecov upload.
• Adds a pypicloud-only, hash-enforced deployment lock, dual-architecture wheel regeneration/release documentation, CLI golden fixtures, empty-input regressions, and the repo-specific Python 3.11 migration contract.

Proof run

• make test: pass, 108 tests and 80% coverage; includes golden rendering, CLI/config smoke, empty-render failure, URL encoding, paragraph-attribute, bidi-link, and legacy-emphasis regressions.
• make lint: pass with Flake8 7.3.0, flake8-pyproject 1.2.4, and the fail-closed msgpack scan.
• venv/bin/python -m compileall email_parser tests: pass.
• venv/bin/pip check: pass with no broken requirements.
• PEP 517 build, Twine metadata checks, wheel/sdist content inspection, extracted-sdist tests, and exact-minimum setuptools==82.0.1/wheel==0.47.0 build proof: pass.
• Fresh isolated 1.0.1 wheel install, package-version assertion, import/render smoke, and CLI smoke: pass.
• Production emails:test_master CLI render: pass for 913 emails, producing 2,739 subject/text/HTML files with exit code 0.
• 0.3.2 versus 1.0.1 production corpus comparison: 942 locale/variant cases with zero subject, visible-text, image, <strong>, or <em> mismatches. The 48 raw-text differences normalize to zero after removing the intentionally cleaned bidi URL wrappers.
• Broader emails:master corpus: 1,130 locale/variant cases rendered without exceptions.
• Downstream email-service candidate-wheel smoke: all 32 CMS tests pass. The downstream branch now pins and hash-locks ks-email-parser==1.0.1 at fe66954.
• Runtime-only co-install with sdiff==2.0.0 and Mistune 3.3.4: pip check, imports, and byte-identical fixture rendering pass without adding either package to this project's metadata.
• Ansible focal-fossa builders produced the amd64 and arm64 deployment wheel sets and combined pypicloud-only lock; both package nodes reported no missing wheels.
• CircleCI at 52ac4a9: prepare_cache, lint, and test all pass.
• GitHub tag 1.0.1 points to 52ac4a9; ks-email-parser==1.0.1 is published internally and both pypicloud package lists have been rebuilt.

Known gaps / follow-up work

• TODO in the emails repository: correct 11 pre-existing malformed URL destinations in emails:test_master. Affected cases are GDPR_Announcement (fr, zh-CN, zh-TW-Hant), family_vault_update_android and family_vault_update_ios (ja, zh-CN, zh-TW-Hant), and Unlisted_announcement_LineUp_users (zh-CN, zh-TW-Hant). After correcting the XML, rerun the 0.3.2-versus-1.0.x corpus comparison and email-service CMS smoke.
• GitHub review approval remains required; all current automated checks pass.
• The email-service production rollout remains downstream operational work; its 1.0.1 dependency pin and lock refresh are complete.
• make test still prints warnings from intentionally malformed XML fallback fixtures; those warnings are covered by passing tests.
• Service-only python311-service-upgrade-stack tasks are intentionally skipped because this repository is library/CLI-shaped: no Gunicorn, PasteDeploy, service INI, workers, Docker runtime, health endpoints, local service stack, or egress guard.

Linear

• BE-93: Upgrade ks-email-parser to Python 3.11

Fixes BE-93