perf: defer the rich, urllib3 and semver imports

[cloudsmith-iduffy]

Description

Defer the last eager imports: rich, urllib3 and semver.

• cli/utils.py imported rich.console/rich.table (~35 ms) at module level; only rich_print_table uses them.
• cloudsmith_cli/__init__.py imported urllib3 (~20 ms with its http.client chain) only to install the InsecureRequestWarning filter. The filter moves to core/session.py: every insecure request (-S/--without-api-ssl-verify) flows through a session from that module, so the filter is installed before any request can warn.
• core/version.py and core/api/version.py imported semver (~6 ms) at module level; only the version parsers use it.

Results

Measured on macOS (M-series), Python 3.14.7, PYTHONDONTWRITEBYTECODE=1 (repo .envrc default). Baseline column = #376.

Command	#376	This PR	Delta
cloudsmith --version	0.18 s	0.12 s	-33%
credential-helper docker get	0.30 s	0.25 s	-17%
Total import time (-X importtime)	60 ms	22 ms of CLI code (88 ms incl. interpreter site)	—

Series summary (vs master)

Command	master	after this stack	Delta
cloudsmith --version	2.72 s	0.12 s	-96%
credential-helper docker get	2.94 s	0.25 s	-91%
Import time (-X importtime total)	2548 ms	88 ms	-97%

With warm bytecode caches (end-user installs; the dev .envrc sets PYTHONDONTWRITEBYTECODE=1 which roughly triples the numbers): docker helper 0.80 s → ~0.10 s.

Methodology (how to reproduce)

1. python -X importtime -m cloudsmith_cli --version 2>&1 | sort -t'|' -k2 -n | tail -25 after perf: skip the SDK import on custom-domain cache hits #376 showed three chains left: rich.console <- cli.utils <- cli.config <- decorators, urllib3 <- cloudsmith_cli (package __init__), and semver <- core.api.version <- commands.main.
2. Confirm each name is unused at module scope (rg for call sites), then defer.
3. Regression guard: HEAVY_PREFIXES in cli/tests/test_startup_imports.py now includes rich, urllib3 and semver.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• Warning-filter timing is preserved: urllib3.disable_warnings now runs when core/session.py is imported, which happens before any session (and therefore any insecure request) exists.

Flame graphs

Probe: cloudsmith --version. Icicle charts from python -X importtime: parents above children, width = cumulative import time. Totals include the interpreter's own site imports and vary a few ms between runs.

Before:

After: