Drop NumPy 1.x and refuse it at import time

[brendancol]

Closes #3751.

NumPy 1.x is no longer supported. install_requires now says numpy >=2.0,<2.5, and xrspatial/__init__.py imports a one-function module first that raises before anything else loads:

ImportError: xarray-spatial requires NumPy 2.0 or newer, found 1.26.4. Upgrade with: pip install 'numpy>=2'

Why an import-time check and not just metadata

The min-deps job went red on 2026-10-10 when pyarrow 26.0.0 came out. pyarrow 26 needs numpy 2 but declares no numpy requirement at all in its metadata, so pip installed it next to the pinned numpy 1.26.0 without complaint. The failure then showed up as AttributeError: 'NoneType' object has no attribute 'concat' in 30 dask zonal tests, because zonal's import dask.dataframe guard swallowed the real ImportError. numba's own numpy check has the same shape: it fires inside a submodule import, several frames away from the cause. A check on the first line of the package turns both into one sentence naming the version found.

Floors that moved with it

Raising numpy to 2.0 means the other floors have to be releases that actually work with numpy 2, or the min-deps job cannot install the set it is meant to test:

• numba 0.59 -> 0.60, the first release that accepts numpy 2 (0.59 declares numpy<1.27)
• scipy 1.11.2 -> 1.13, the first built against numpy 2 (1.11 and 1.12 declare numpy<1.28)
• pandas 2.2 -> 2.2.2, the first 2.2.x without the numpy<2 cap

The derivation comment block in setup.cfg is updated to match, and the min-deps pins become numba==0.60.0 scipy==1.13.0 numpy==2.0.0 pandas==2.2.2 (xarray, urllib3 and zstandard unchanged).

Tests

• test_numpy_floor.py: the check rejects 1.x strings (including dev builds) with the version in the message, passes 2.x and later, and passes on the installed numpy.
• test_dependency_metadata_3701.py: new test_numpy_floor_is_two asserts the metadata agrees with the check.
• End to end: in a venv with only numpy 1.26.4, import xrspatial raises the message above and nothing else.
• Locally replicated the min-deps install on 3.12 with the new pins: pip install -e .[tests] with the pins resolves (numpy 2.0.0, numba 0.60.0, scipy 1.13.0, pandas 2.2.2, pyarrow 26.0.0 all import together) and the fast lane gives 11003 passed, 1 failed. The one failure is the Hypothesis fuzz case in geotiff: a single corrupt byte in ModelTiepointTag raises NotImplementedError instead of a typed parse error #3752, replayed from the local example database; it is unrelated to numpy.

Note for #3753: that PR moves the numpy cap to <2.6 on the same line. Whichever merges second needs a one-line rebase.