v0.8.10

🔒 Security — mistune 3.3.2 → 3.3.4 (dev dependency)

• Bumped the transitive mistune dev dependency (pulled in via
  jupyter → nbconvert) from 3.3.2 to 3.3.4 via
  uv lock --upgrade-package mistune, resolving GHSA-6m44-fpc8-c3rq
  (HIGH). Dev-only; no runtime dependency change.

🐛 Bug Fixes — Core

• X/y desync on duplicate index labels (OC-12): the pandas paths of
  DropMissingRows and Deduplicate selected y by label
  (y.loc[X_clean.index]); with duplicate index labels .loc returns all
  matching rows, so y came back longer than X with misaligned labels — a
  silent wrong-labels bug. Both paths now compute a positional keep mask
  (notna threshold / duplicated), select X.iloc[kept], and filter y
  positionally via the new _pandas_filter_y_by_kept_positions helper in
  preprocessing/drop_and_missing/_common.py, mirroring the already-correct
  polars paths. Added duplicate-index regression tests in
  tests/integration/test_drop_rows.py and
  tests/integration/test_drop_and_missing_gaps.py.

• Numeric→boolean cast divergence on polars (OC-58): polars' default
  numeric→Boolean cast is C-style truthiness (x != 0) and never raises, so a
  value like 2.0 silently became True on polars while pandas
  (astype("boolean")) produced <NA> — and strict mode raised on pandas but
  not on polars. The polars path in preprocessing/casting.py now mirrors the
  pandas reference: only exact 0/1 values map to False/True, everything
  else (including non-integer floats) becomes null, and strict mode raises
  ValueError on those nulls. Added regression tests in
  tests/integration/test_casting.py (coerce, strict, pure 0/1, and
  engine-parity cases).

• Non-reproducible fingerprint() for object-dtype arrays (OC-62):
  artifact_digest in pipeline/seal.py digested np.ndarray via
  arr.tobytes(); for dtype=object arrays that serialises raw PyObject*
  pointers, which are allocator/ASLR dependent — so the fingerprint of any
  artifact holding an object-dtype array (e.g. OneHotEncoder/LabelEncoder
  categories_) changed across processes and was useless for caching or
  comparison. The ndarray branch now digests the shape plus each element
  recursively, so the digest reflects values. Added regression tests in
  tests/unit/test_pipeline_coverage.py.