Release rehearsal: TestPyPI dry-run before v0.1.0

[bordeauxred]

Why

PyPI 404 ≠ launch-safe. First-publish failure modes that won't surface until the real release: name normalization, project metadata validation, README rendering quirks, Trusted Publisher mismatch, attestation surprises, direct-reference extras (we have one for tau2). The cost of a rehearsal is ~20 min; the cost of a botched real release is unrecoverable for that version number.

What

• Configure pending Trusted Publisher on TestPyPI for project `clawloop`, owner `aganthos`, repo `clawloop`, workflow `publish.yml`, environment `testpypi` (or upload via API token if simpler).
• Locally: `python -m build && twine check dist/*`.
• Upload to TestPyPI: `twine upload --repository testpypi dist/*`.
• Fresh-venv install from TestPyPI: `pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ clawloop==0.1.0`. Verify `clawloop demo math --dry-run` works.
• Visit `https://test.pypi.org/project/clawloop/0.1.0/\` and confirm README renders cleanly (PyPI's reST/markdown handling can surprise).
• Configure pending Trusted Publisher on production PyPI with the same parameters.
• Document the rehearsal procedure in `CONTRIBUTING.md` or a release runbook so future maintainers don't skip it.

Acceptance

TestPyPI install + demo works. README renders correctly on TestPyPI. Production Trusted Publisher configured. Release procedure documented.

Why this is launch-blocking

The plan currently lists this as P1; Codex review (2026-04-19) recommends promoting to P0. A bad first publish to PyPI cannot be reverted — version 0.1.0 is permanently consumed.