v0.3.2 — names are labels, sidecars are truth; installable C++

v0.3.2 — names are labels, sidecars are truth; installable C++

An integration and insurance release: artifact identity moves from filenames
into metadata, the C++ library becomes properly installable, and the release
process itself is now mechanical. Model files are byte-identical to v0.3.1 —
no re-export needed, no precision recipe changed.

Behavior changes

• Engine resolution reads the sidecar, not the filename. The CLI picks a
  cached engine's batch profile from its JSON sidecar (the filename regex
  remains only as a fallback for pre-sidecar engines), and an engine whose
  recorded onnx_sha256 contradicts the resolved ONNX is refused with a
  warning instead of served — a hand-copied or renamed engine can no longer
  silently answer for the wrong model. docs/NAMING.md documents the whole
  scheme (four identity axes; name grammar assembled in exactly one place).
• dfine_build (C++ builder) refuses non-FP32 graphs up front. Before, a
  slim/fp16 ONNX went through a minutes-long build and came out stamped
  precision: fp32 next to the converter's contradicting precision_mode.
  Use the mAP-validated Python pipeline (build_engine.py) for fp16/int8.
  Its default engine name also switches from <stem>-fp32.engine to
  <stem>_fp32.engine — the underscore grammar every other tool discovers.
• dfine export warns before overwriting a cached slim/legacy export
  (previously only the FP32 base got the different-checkpoint note).
• Engine sidecars carry more build truth: schema_version: 1, sm_arch,
  tf32, max_aux_streams join the existing fields, and publishing an engine
  removes a stale appended-name sidecar twin that would otherwise shadow the
  fresh one for every reader.

New: use dfine from your own CMake project

cmake --install now ships a complete config package: versioned .so chain,
public headers (TensorRT/CUDA-free — PIMPL), dfineConfig.cmake with
find_dependency resolution through the bundled FindTensorRT.cmake.

find_package(dfine CONFIG REQUIRED)
target_link_libraries(your_app PRIVATE dfine::dfine)

examples/consumer/ is the documented out-of-tree consumer; a new CI job
installs to a prefix, audits relocatability (no RPATH, no build-machine
paths, SONAME libdfine.so.1), and builds the consumer outside the checkout
on every commit.

Diagnostics and contracts

• Loader: DFINE_LIBRARY pointing at a missing file is now a hard error
  (an explicitly requested library is never silently substituted), and when
  nothing loads, the error lists both the searched paths and each dlopen's
  own words — "not found" vs "found but missing a dependency" finally look
  different.
• Log callback: c_api.h states the real contract (any thread, message
  valid only during the call, the swap does not drain in-flight invocations —
  keep installed callbacks alive for the process lifetime). The Python wrapper
  now follows it by keeping every installed trampoline alive.

Release and validation tooling

• trt-files/scripts/release_assets.py replaces the hand-assembled
  SHA256SUMS: assemble validates the 20-file release grammar (graph/sidecar
  pairing, precision-vs-suffix, opset) and writes the manifest with the wheel
  included; verify --tag downloads a published release back and fails on any
  mismatch or any published asset the manifest does not cover. Both modes are
  how this release was produced and checked.
• trt-files/scripts/validation_report.py + docs/VALIDATION.md: anyone with
  a different GPU/TensorRT can produce a comparable report (environment, asset
  hashes, engine build, benchmark) and submit it as a validation-matrix row.
  The Ada/WSL2 row ships with this release.

Housekeeping

SPDX license strings (PEP 639) and package auto-discovery silence both
setuptools deprecation warnings in the wheel build; the wheel-bundled
_scripts/ no longer trips packaging. One stale ruff ignore dropped.