python-mcp-bootstrap v0.1.6

First release produced and verified by the hardened draft-first gates.

Highlights

The prepare-release final gate now verifies the draft release assets
(releases-list resolution plus asset-id downloads) instead of skipping a
release it could not read through gh release view. The release gate also
rejects duplicate changelog headings.
--python values beginning with - are usage errors (python_flag_missing,
exit 2); verify_import rejects Python keywords; card must be non-empty;
URL redaction masks passwords containing @ through the last @.
Coverage and strict mypy now include scripts/; packaging tests cover
distribution metadata, the console-script entry point, __all__, and the
python -m version smoke.
README gained "Why this is public", PyPI-friendly absolute links, and an
accurate version history; CONTRIBUTING documents that the only version
literal is __init__.__version__.
The version is single-sourced from __init__.__version__; pyproject.toml
has no version, and the wheel job checks that installed metadata matches.

v0.1.6 is an annotated tag. prepare-release builds from the tag, writes
SHA256SUMS, creates a draft, uploads the assets, attests provenance, signs
every artifact, and verifies the draft. Publishing the draft fires
publish.yml, which verifies checksums, the full release gate, and both
artifact attestations before publishing to PyPI last with OIDC trusted
publishing.
The release is immutable with seven assets: wheel, sdist, SHA256SUMS, three
.sigstore.json bundles, and provenance.intoto.jsonl.
Tags are unsigned; artifact signatures and provenance live in the release
assets.