#591)

The `pkg_meta` CI environment started failing on every branch with:

```
twine check ... ERROR InvalidDistribution: Invalid distribution metadata: '2.5' is not a valid metadata version
```

hatchling 1.30.0 began emitting `Metadata-Version: 2.5` (PEP 794, adding
`Import-Name`/`Import-Namespace`), and `[build-system].requires` pinned
only `hatchling>=1.27`, so fresh CI resolved to 1.30. 🔧 The problem is
not just the checker: metadata 2.5 cannot actually be published today.

- The latest released twine (6.2.0) monkeypatches `packaging`'s
validator to a hardcoded list ending at 2.4, so `twine check` rejects
2.5. The monkeypatch was removed in pypa/twine#1317, but that is
unreleased — there is no twine release that accepts 2.5, so bumping the
`twine>=` floor is not an option.
- PyPI itself does not accept Metadata-Version 2.5 uploads yet —
pypi/warehouse#19083 is still open; warehouse supports up to 2.4.

So a 2.5 wheel is unpublishable regardless of the checker, and
`pkg_meta`'s red is correct signal. The minimal fix that keeps the
package genuinely publishable is to cap the build backend just below the
version that introduced 2.5:

```
hatchling>=1.27,<1.30
```

This produces Metadata-Version 2.4, which both released twine and PyPI
accept. Verified `tox -e pkg_meta` goes green (uv build + twine check +
check-wheel-contents). ⏳ A comment in `pyproject.toml` marks this as
removable once twine ships pypa/twine#1317 and PyPI implements
pypi/warehouse#19083 — at which point the cap should drop and the
`twine>=` floor bump instead.

Refs:
- pypa/twine#1146 — twine fails on latest metadata-version (tracking)
- pypa/twine#1317 — removes the validator monkeypatch (merged,
unreleased)
- pypi/warehouse#19083 — PyPI support for Metadata 2.5 (open)

Follow-up to #591. That PR capped `hatchling<1.30` because 1.30 emitted
Metadata-Version 2.5 (PEP 794), which no released twine and PyPI accept
yet.

hatchling 1.30.0 has since been **yanked** from PyPI, with the yank
reason: *"the default core metadata version was increased to 2.5 and
some major projects like twine do not yet support it."* pip and uv skip
yanked releases during resolution, so the build now lands on 1.29.0
(Metadata-Version 2.4) without any upper bound. ⏪ The explicit cap is
therefore redundant.

Dropping it back to `hatchling>=1.27` keeps us forward compatible: the
full chain to publishing 2.5 needs a twine release (pypa/twine#1317),
then a pypa/gh-action-pypi-publish release, then dependabot bumping the
pinned publish action — once that lands, a future unyanked hatchling can
emit 2.5 without another pyproject edit.

Verified locally: with no cap the build resolves to hatchling 1.29.0,
emits Metadata-Version 2.4, and `tox -e pkg_meta` passes (uv build +
twine check + check-wheel-contents).

Refs:
- #591 — the cap this reverts
- pypa/twine#1317 — removes the validator monkeypatch (merged,
unreleased)
- pypi/warehouse#19083 — PyPI support for Metadata 2.5 (open)