WCAB 0.37.0 — External-data source review

Relationship-backed external-data source review

• Adds governance.external_data_connection_source_changed, a deterministic pair that moves only xl/connections.xml webPr/@url between two reserved .invalid endpoints.
• The validator proves the fixed connection identity and refresh controls, workbook relationship and content type, saved imported cell, direct local formula path, calculation properties, and xl/connections.xml-only package boundary. It never opens, fetches, authenticates to, trusts, refreshes, or calculates either source.
• Adds the exact external_data_connection_web_query_url_changed truth fact, URL-only isolation/corruption regressions, and a strict optional FormulaFence mapping requiring safe web_query_url evidence plus high-severity FF023.

WCAB now contains 54 cases, 56 observable facts, 44 block cases, 10 review cases, and three scoreable coverage expectations.

Validation: 254 tests passed; 54 fixtures validate; wheel/source fresh installs reproduce the committed manifest byte-for-byte; GitHub Actions passed on Python 3.10 and 3.13.

SHA-256:

• workbook_change_benchmark-0.37.0-py3-none-any.whl: 3361e863413ae770492e9e585db6948d692c7bb6447869a788af514aefd1897a
• workbook_change_benchmark-0.37.0.tar.gz: a7d6d8c4edc45dae95e5b6cf8056e514a8f30df76f2b681c2da35cafafae78b5