Add Ruby 4.0 to CI and fix stdlib dependency issues

[David Elner (delner)]

Ruby 4.0 was officially released Dec 2025. This PR adds it to our CI matrix and fixes dependency issues caused by gems being extracted from the standard library in Ruby 3.4+ and 4.0.

No SDK code changes required — the SDK itself is already Ruby 4.0 compatible.

Changes

CI (ci.yml)

• Add '4.0' to the Ruby version matrix
• Update ruby/setup-ruby from v1.270.0 to v1.295.0 (adds Ruby 4.0.2 support; the old version only had 4.0.0-preview2)
• Add bundler: 'latest' — Ruby 4.0-preview2 shipped with a broken bundler 2.4.19; using latest avoids this

Dependencies

• braintrust.gemspec: Move development dependencies to Gemfile (gemspec now only has runtime deps)
• Gemfile: Add all development dependencies here instead of gemspec
• Gemfile.lock: Bump BUNDLED WITH from 2.4.19 to 4.0.8 (prevents bundler from auto-downgrading to the broken version)
• Appraisals: Add base64 and cgi as supplemental deps for openai and anthropic gems — these upstream gems use base64/cgi without declaring them, which breaks on Ruby 3.4+ (where base64 was removed from default gems) and Ruby 4.0+ (where cgi was removed)

Appraisals refactor

• Merge GEM_DEPENDENCIES into OPTIONAL_GEMS — each version entry is now a hash with constraint and deps keys, so supplemental dependencies can be scoped per-version instead of applied to all versions of a gem

Other

• Suppress base64 stdlib warning in encoding_test.rb (the test already handles LoadError gracefully; the warning was just noise)

Context

Ruby 3.4+ and 4.0 have been progressively extracting gems from the standard library:

• base64: Warning in Ruby 3.4, removed in later 3.4.x patches
• cgi: Removed in Ruby 4.0
• logger: Removed in Ruby 4.0 (already declared as a runtime dep in our gemspec)

Several upstream gems (openai, anthropic) use these without declaring them, so we add them as supplemental deps in our appraisal configurations.