chore: release v0.3.2

[szjanikowski]

[0.3.2] — 2026-05-07

Added

• PyPI publishing. nasde-toolkit now ships to PyPI;
  install with uv tool install nasde-toolkit (or pipx/pip). Tag pushes
  trigger an automated publish.yml workflow that builds, runs a fresh-install
  smoke test on TestPyPI, gates the production publish on the smoke test
  passing, then publishes to PyPI and creates a GitHub Release. (feat: PyPI publishing + in-CLI update notifier #36, chore(release): operationalize PyPI publishing — bump harbor, smoke gates, docs #38)
• In-CLI update notifier. nasde checks PyPI for newer releases on
  startup and prints a one-line notice on stderr when one is available
  (severity-tinted: patch / minor / major). Notify-only — never auto-applies,
  never prompts. Skips on no-TTY, NASDE_NO_UPDATE_CHECK=1, CI=true, and
  dev/pre-release builds. Cached for 24h via platformdirs. (feat: PyPI publishing + in-CLI update notifier #36)
• Weekly TestPyPI canary. Monday 09:00 UTC cron re-publishes a fresh dev
  build to TestPyPI and runs the smoke test against it — catches transitive
  dependency breakage (e.g. an upstream wheel going bad) in the window
  between releases. (chore(release): operationalize PyPI publishing — bump harbor, smoke gates, docs #38)

Changed

• Bump harbor to >=0.6,<0.7 (latest 0.6.4). Adapter additions,
  Modal/Windows support, gemini-cli v0.40+ session improvements, plus a
  field rename in JobStats (n_trials → n_completed_trials) that the
  runner now handles. No user-facing CLI or config changes. (chore(release): operationalize PyPI publishing — bump harbor, smoke gates, docs #38)
• Refresh opik to 2.0.22 within the existing >=2,<3 range. (chore(release): operationalize PyPI publishing — bump harbor, smoke gates, docs #38)
• Enriched pyproject.toml with project URLs, classifiers, and keywords
  for a proper PyPI project page. (feat: PyPI publishing + in-CLI update notifier #36)

Fixed

• Strip the local-version segment (+gHASH) from hatch-vcs output so dev
  builds are PyPI-acceptable as pre-releases (0.3.2.devN instead of
  0.3.2.devN+gabcdef). PEP 440 forbids local versions on the public index. (fix(build): drop local-version segment from hatch-vcs output #37)
• Pin supabase>=2.29.0,<3 to skip broken upstream wheels. supabase 2.28.3
  and 3.0.0a1 ship wheels missing the _async/ and _sync/ subpackages,
  which made nasde --version crash at import in fresh installs. (chore(release): operationalize PyPI publishing — bump harbor, smoke gates, docs #38)
• Adapt _print_job_summary in the runner to harbor 0.6's JobStats field
  rename; previously crashed with AttributeError after a successful trial. (chore(release): operationalize PyPI publishing — bump harbor, smoke gates, docs #38)

Docs

• Rewrote docs/RELEASING.md and docs/ci-setup.md for the automated
  publish flow. Includes a recovery table for failure modes encountered
  during pipeline verification. (chore(release): operationalize PyPI publishing — bump harbor, smoke gates, docs #38)

Internal

• publish.yml workflow with PyPI Trusted Publishing (OIDC) — no long-lived
  tokens or secrets. Reuses quality-gate.yml via workflow_call. (feat: PyPI publishing + in-CLI update notifier #36)
• pyproject.toml: explicit packaging>=25,<26 dependency (used by the
  update notifier; was previously transitive). (feat: PyPI publishing + in-CLI update notifier #36)
• TestPyPI uploads use skip-existing: true so re-runs of workflow_dispatch
  with the same devN filename are no-ops instead of 400 File already exists. (chore(release): operationalize PyPI publishing — bump harbor, smoke gates, docs #38)

---

Versioning rationale (patch, not minor). The user-facing CLI, nasde.toml schema, task.toml schema, and benchmark project layout are all unchanged. PyPI publishing is a delivery-mechanism change. The update notifier is opt-out, stderr-only, suppressed in CI/non-TTY, and adds a single line on startup. Per RELEASING.md: "Transitive or internal dep bump with no visible behavior change → patch. The user's nasde.toml, benchmark layout, and CLI output are unchanged." Bumping to v0.3.2 signals "safe to upgrade" rather than v0.4.0's "minor bump, check what changed."