v4.0.0: single grouped breaking release (tracking)

[luisgf]

Horizon: long · Effort: L (grouped) · 2026-07 roadmap analysis

Several roadmap items each imply a breaking change; shipping them as separate majors would be adoption poison, leaving them open forever is worse. This issue groups them into one planned, pre-announced 4.0.0:

Update — scope change: the OB1-removal item below is cancelled. OpenBadges 1.0 is now a supported legacy surface with no removal planned — removing a working, dependency-free legacy path was judged excessive (OB1 carries no unique deps since #167). The library DeprecationWarnings and -V 1 CLI notices were reworded to steer new work to OB2/3 without promising removal. See the "OpenBadges 1.0 lifecycle" policy on the Python-API-OB1 wiki page. The rest of the grouped 4.0.0 scope stands.

• remove OB1: openbadgeslib/ob1/, the three top-level shims and the unprefixed __init__ re-exports, _sign_ob1/_verify_ob1 CLI paths, and the OB1 mail path — CANCELLED: OB1 stays as a supported legacy surface (no removal planned); -M/--mail-badge stays with it.
• drop pycryptodome + python-ecdsa for good (remove the soft-import compat; the keys.py port issue is the prerequisite)
• unify human-mode exit codes: OB1/OB2 invalid badge currently exits 0 without --json while OB3 exits 255 ("historical behaviour preserved", openbadges_verifier.py) — the breaking fix lands here under the 0/1/2 contract
• drop Python 3.10 (EOL 2026-10), per the written Python support policy (governance issue)
• decide: unified openbadges CLI with subcommands (init/keygen/sign/verify/publish/status) reusing the existing build_parsers, the 5 current scripts as soft-deprecated aliases; -c/-V/-d/--json defined once (openbadges-init today has no argparse, no --version, no -d) — done: the front-end and shared parent parsers in v4.0.0: cli_common parent parsers and the unified openbadges <command> front-end #234, the sixth subcommand status in 5dedfca. The scripts stay plain aliases, not soft-deprecated (see the scope note above); status is front-end only, with no openbadges-status script.
• deprecation window announced in README/wiki well ahead of the release

[luisgf]

Prerequisites before this release can ship: #159 (OB1 deprecation clock), #167 (keys.py port — enables the final dep drop), #166 (the non-breaking half of the exit-code contract), #174 (written Python support policy for the 3.10 drop). Tracking: #175.