R5: Release engineering — tag pipeline, build artifacts, GitHub Release for v0.1.0

[jmcte]

Goal

Wire the tag-to-release pipeline so cutting v0.1.0 produces signed, reproducible build artifacts attached to a GitHub Release. PyPI publishing is explicitly out of scope for v0.1; we'll revisit in a follow-up.

This is R5 of six release milestones (R1–R6) leading to v0.1.0.

Evidence

• project.bootstrap.yaml:111-113 — capabilities.release.enabled: false, kind: none. No release pipeline exists today.
• No tags in git tag output.
• pyproject.toml:7 — version 0.1.0 hardcoded.

Acceptance criteria

Release workflow

• New .github/workflows/release.yml triggers on tag push matching v*.*.* and:
  1. Runs the fast-CI suite as a gate.
  2. Builds sdist and wheel via python -m build.
  3. Computes SHA256 sums of both artifacts.
  4. Creates a GitHub Release for the tag, with the matching CHANGELOG.md section as the body, and attaches the sdist, wheel, and SHA256SUMS file.
• Workflow uses GitHub-hosted runners (per AGENTS.md runner policy, since python -m build is reasonably trusted but a fresh runner each time is preferred).
• Workflow enforces tag matches pyproject.toml version (mismatch fails the job).

Manifest update

• project.bootstrap.yaml flips capabilities.release.enabled: true and sets kind: github-release (or whatever the bootstrap tool expects).

Pre-release validation

• One-shot script scripts/release/dry-run.sh (or workflow_dispatch entry) that performs the full build steps without creating a release, for sanity checking before tagging.
• CI Gate (the required PR check named in project.bootstrap.yaml:60) covers the release workflow's build step on PRs that touch packaging — at minimum python -m build is exercised in extended CI.

Cut v0.1.0

• After R1–R4 are closed, tag v0.1.0 from main and confirm the workflow produces a release.
• Release notes include the explicit "what's stubbed" callout from R4.
• README.md install section is updated post-release to show the canonical wheel URL or pip install <tag URL> form.

Out of scope

• PyPI publishing (deferred; file follow-up R5b once project name is reserved).
• Release signing (sigstore / GPG) — note as candidate for v0.2.

Definition of done

• Tag v0.1.0 exists and the matching GitHub Release has the wheel + sdist attached.
• A user can pip install the wheel from the GitHub Release URL and mpi doctor works.