pip-rns 1.5.0

Zipapps, kits, and no-pip bootstrap

• Signed zipapps (opip.pyz, pip-rns.pyz) run with only a Python interpreter
• self-install places opip and pip-rns on PATH via manual extract, uv, or ensurepip
• get-opip.py builds those zipapps from a browser-downloaded wheel or Tor URL
• opip kit create / kit verify builds USB airgap kits with optional portable CPython
• kit create --as-app writes AppImage-style ./Run launchers
• HTTP(S) and SOCKS5(h) proxy for create and kit downloads (--proxy, OPIP_PROXY)
• --break-system-packages and --backend manual for installs when pip is absent
• pip-rns local wheel install falls back to uv or manual extract when pip is missing
• Help topics: opip help airgap, pip-rns help bootstrap

Docs and repository hardening

• Docsify docs site on GitHub Pages (pip-rns.quad4.io)
• GitHub Actions supply-chain hardening (Harden Runner first, pinned workflows)
• Scorecard and CodeQL fixes (TLS 1.2 floor, safer URL handling, dependency policy)