Replicant v0.3.1

A packaging fix. Nothing changes for anyone running from a git clone, which is how 0.3.0 was tested and how CI runs. Everything in v0.3.0 still applies.

Fixed: a wheel install produced a tool that could not run

pip install of the 0.3.0 artifact succeeded and replicant --version printed 0.3.0. Every other command then failed with catalog not found, and the web UI served its "build the frontend" placeholder instead of the real interface.

Everything Replicant needs at run time lived outside the package and was reached by repository-relative paths. pyproject.toml packages replicant* and there is no MANIFEST.in, so the wheel contained 40 entries: the Python modules and py.typed, no catalogs and no built frontend. It was also dependent on the working directory, because the CLI fell back to Path.cwd(). That is why it went unnoticed. From a checkout it worked and from anywhere else it did not, and every test imports from the source tree, so the suite stayed green while the artifact was unusable.

• data/ moved to replicant/data/, and the frontend build output moved to replicant/webui_dist/. Both now sit inside the package.
• replicant/resources.py is the single place that knows where runtime files live.
• package-data covers the catalogs, the built UI, and its fonts.
• Catalog resolution prefers the packaged copy over working-directory guesses. An explicit catalog_path setting still wins.
• docs/ is deliberately not packaged. A second copy inside the package would drift from the first.

This closes the "the built wheel is not yet self-contained" limitation recorded under 0.1.0.

Added: guards, because unit tests structurally could not catch this

• tests/test_packaging.py asserts runtime files resolve inside the package, that package-data actually covers them, and that the catalog resolves from an empty working directory.
• A wheel CI job builds the frontend, builds a wheel, installs it into a clean virtualenv and runs it from an unrelated directory.
• The version is asserted to be single-sourced: replicant.__version__ and pyproject.toml have to agree.

Also corrected: replicant/__init__.py still described the package as FortiGate-only. It renders FortiGate, Palo Alto PAN-OS and Check Point, and has since Phase 3.

Verification

From a clean virtualenv outside the repository, in a directory containing no data/: replicant list shows 24 techniques, a run writes 36000 CEF lines, replicant scenario list works, and the web UI serves the real single-page app.

526 Python tests, 68 frontend, black / ruff / mypy / shellcheck clean. All 10 CI jobs green.

Replicant generates synthetic telemetry for detection engineering in a lab. It writes log text and never executes attacks.