0.5.1 — the first release after going public

The first release cut after the repository became public. Its reason for existing
is unglamorous: a PyPI project page's description is frozen at upload time, so
0.5.0's page keeps a broken wordmark and ~30 dead links to a repository that was
private when it was published. Only a new version picks up a working README.
Everything else here is hardening that accumulated behind it.

Added

• ankusdrive doctor certifies the MCP server itself — a real stdio handshake —
  rather than stopping at FreeCAD resolution (#289).
• scripts/install-core.ps1: the whole Windows first run as one script — venv,
  the pins that matter, doctor, an MCP handshake, and a registration block with
  absolute paths filled in (#290).
• A documented install path for Ubuntu 24.04+ and containers, where apt has no
  FreeCAD candidate and snap/flatpak both fail: the official AppImage, extracted
  (#291).
• SECURITY.md — a private reporting route, a scope statement for a project whose
  headline feature is executing Python, and what is handled upstream
  (#305).
• Per-platform solver install guides — macOS, Linux, and Windows — transcribed
  from the reference machines and scrubbed to placeholders
  (#320).
• CONTRIBUTING.md (the seven registration points a new tool touches, the CI
  lanes, and a Releasing section), a Contributor Covenant 2.1
  CODE_OF_CONDUCT.md, and this changelog
  (#318).
• An issue chooser whose contact link routes a suspected vulnerability to
  private reporting instead of a public issue — plus bug / question /
  tool-request forms and a PR template
  (#322).

Changed

• bounding_box reports the analytic box as the upper bound it is, and can measure
  the tight one instead of implying it already did
  (#294).
• Three docs/ plans whose work had shipped moved to docs/archive/; three more
  that survived the sweep were rewritten, because surviving an archive pass is not
  the same as having been read (#305).
• Every PR-triggered CI lane runs on GitHub-hosted runners. A green Windows run
  now certifies the documented install path end to end — the FreeCAD portable
  archive plus scripts/install-solvers.ps1 su2 elmer, landing exactly where
  solver discovery probes (#326).
• tests/run_all.sh falls back to python3 when there is no .venv, so a
  machine where one interpreter satisfies every import runs the whole suite
  under it (#326).

Fixed

• boolean_op names the two degenerate cuts — no intersection, and a cut that
  removes everything — instead of returning a volume that looks like a result
  (#292).
• fillet_edges validates the blend before handing back a handle, and names the
  edge that broke it (#293).
• The macOS heavy-solver lane reports the stale-rename failure by name, and stops
  reading a stderr warning as a verdict
  (#304).
• The MCP test suite forwards ANKUSDRIVE_* to the server it spawns. The stdio
  client's scrubbed default environment silently dropped every override, so the
  suite passed only where FreeCAD was findable by PATH or glob luck
  (#326).
• Two tests asserted environment variables the CI box merely happened not to
  export (#319).

Security

• Every commit on every ref is scanned for credentials in CI, by a gitleaks binary
  pinned to a version and verified against its published checksum rather than
  trusted by tag (#300).
• All 18 GitHub Action references are pinned to commit SHAs, each resolving the tag
  already in use rather than silently taking a major bump
  (#301).
• Fork pull requests cannot reach a persistent machine, structurally. First the
  self-hosted lanes learned to skip them (#302);
  then every PR-triggered lane moved to hosted runners outright, so fork PRs run
  the FULL suite and the exposure class is gone rather than trigger-guarded
  (#326). Self-hosted machines
  serve only scheduled solver regressions.
• The repository is public as of 2026-09-10, with the protections that only
  exist on public repos turned on the same hour: branch protection with five
  required hosted checks and linear history, a v* tag ruleset, secret scanning
  with push protection, SHA-pinning enforcement for every action, private
  vulnerability reporting, and Dependabot
  (#303).
• A fast-lane guard sweeps every tracked file and path for machine-identifying
  content — home directories, hostnames, tailnet names, ANY contributor's, in
  any encoding — without itself naming what it forbids
  (#323); self-hosted job logs
  mask the runner's identity before the first step prints
  (#325).