Release v0.5.0

[xeonvs]

Summary

• prepare the stable 0.5.0 release for M2 ecosystem and framework coverage, including Jinja2-first template evidence, Go/PHP/frontend framework providers, and the existing built-in evidence MCP projection
• consume the 0.5.0 Towncrier fragments, advance the development line, and bind release authorization to issues [Bug]: Make stable release recovery idempotent across partial external state #76 and [OCR compatibility] Qualify v1.9.2 #78
• archive the externally reconciled 0.4.7 execution plan and keep M2 honestly in progress until stable external delivery is independently read back
• quote the isolated quality-environment export found during the release audit and retain its contract regression

Local validation

• full quality gate and complete tests on Python 3.12, 3.13, and 3.14
• release/authorization/receipt/process contracts, OCR compatibility manifest, lockfile, ShellCheck, workflow YAML, dependency audit, privacy, and Gitleaks
• two byte-identical stable 0.5.0 wheel/sdist builds with Twine and closed archive inspection
• hash-locked supported-Python installs with hostile-shadow and restricted-PATH probes
• installed stable-wheel stdio MCP protocol E2E and checksum-qualified OCR 1.9.2 JSON rules preview for Jinja, Twig, and extensionless role templates

External gates

This is the final repository mutation for the 0.5.0 lifecycle. Stable TestPyPI/PyPI files, registry provenance, GitHub attestations, the annotated tag, immutable GitHub Release, release-receipt.json, published-artifact installs, issue receipts, and closure of #76/#78 remain pending until after this exact reviewed tree is squash-merged and independently verified. No follow-up repository closure PR is planned.