Manual bump to step past the v2.28.0 tag-collision that blocked the
prior release attempt. Background: v2.28.0 was tagged on a sibling
release branch and published to PyPI (cloud-secrets + deployment
contract feature). That tag-commit was never merged into main, so
semantic-release on main's history walks from v2.27.2, sees the
`feat:` commit that originally produced v2.28.0, decides "next
version is 2.28.0", and fails at `git tag v2.28.0` because the
tag already exists.

Manually bumping to 2.28.1 + tagging v2.28.1 at HEAD makes that the
new "latest reachable tag" from main. semantic-release on the next
push walks forward from there and increments cleanly. The publish
workflow then ships 2.28.1 to PyPI carrying the log-scrub work + the
test-fixture factory hygiene that landed after v2.28.0.