Add Zenodo DOI auto-minting config for GitHub Releases

[igerber]

Summary

• Add .zenodo.json at repo root so Zenodo's GitHub App can mint a concept DOI + per-version DOI on every future release. Metadata: upload_type=software, MIT license, ORCID-tagged creator, related identifiers linking the record to the GitHub source (isSupplementTo) and ReadTheDocs (isDocumentedBy).
• Add LICENSE (standard MIT, single-holder copyright) — the repo declared MIT in pyproject.toml and CITATION.cff but had no LICENSE file.
• Bump CITATION.cff from 3.1.1 to 3.1.2 (matching the shipped release) and update date-released.
• Extend [tool.maturin].include to cover LICENSE so the file lands in the sdist tarball, not just in PKG-INFO's License-File: metadata.

One-time Zenodo setup (done out-of-band, not part of this PR):

• Zenodo account linked to GitHub, igerber/diff-diff toggled ON at https://zenodo.org/account/settings/github/. The first release tag after v3.1.2 will fire the Zenodo webhook.

Methodology references

• N/A — no methodology or estimator changes.

Validation

• No test changes (pure release-infrastructure metadata).
• .zenodo.json parses as valid JSON; enums (upload_type, access_right, license, relation) spot-checked against https://developers.zenodo.org/#deposit-metadata.
• maturin sdist runs clean, no license-file warnings, and the produced tarball contains LICENSE at its root plus License-File: LICENSE in PKG-INFO.

Security / privacy

• Confirm no secrets/PII in this PR: Yes.

Follow-up (out of scope here)

• After the first Zenodo-minted release, a small PR will add the concept-DOI badge to README and a doi: line to CITATION.cff.

---

Generated with Claude Code

[github-actions]

Overall assessment

✅ Looks good. No unmitigated P0/P1 findings in the changed scope.

Findings

• P3 The PR adds a second release-metadata source in .zenodo.json:L1 alongside CITATION.cff:L1, but it does not add any automated validation to keep overlapping fields aligned. Zenodo’s GitHub integration uses .zenodo.json in preference to CITATION.cff, so future drift would silently produce different metadata in Zenodo than in the GitHub citation box. Impact: low, release-metadata inconsistency only. Concrete fix: add a small CI/test step that parses .zenodo.json, validates CITATION.cff, and asserts shared fields stay in sync. (support.zenodo.org)

Executive summary

• No methodology-impacting code changed; the diff is limited to .zenodo.json:L1, CITATION.cff:L1, LICENSE:L1, and pyproject.toml:L85.
• CITATION.cff is internally consistent with package metadata: CITATION.cff:L10 matches pyproject.toml:L7 at 3.1.2.
• Adding LICENSE:L1 and including it via pyproject.toml:L98 closes the packaging gap without touching runtime behavior.
• The only review item is low severity: no automation currently guards against future .zenodo.json / CITATION.cff drift.

Methodology

• Severity: none. Impact: no estimator, math, weighting, variance/SE, identification assumption, or default-behavior code changed; after checking REGISTRY.md:L1, there is no affected method to cross-check against source papers. Concrete fix: none.

Code Quality

• Severity: none. Impact: the changed metadata is mechanically sound in scope; .zenodo.json parses cleanly, and version metadata is consistent between CITATION.cff:L10 and pyproject.toml:L7. Concrete fix: none.

Performance

• Severity: none. Impact: no runtime or estimator path changed, and adding LICENSE to pyproject.toml:L98 is negligible at build time. Concrete fix: none.

Maintainability

• Severity: none. Impact: the diff is small and localized, and the new metadata remains consistent with existing package metadata in this PR. Concrete fix: none.

Tech Debt

• Severity: none. Impact: no new deferred correctness debt was introduced, and I did not find a changed-scope issue that needs TODO.md tracking to make this PR acceptable. Concrete fix: none.

Security

• Severity: none. Impact: no secrets, tokens, or executable attack surface were introduced; the changes are limited to public citation, license, and release metadata. Concrete fix: none.

Documentation/Tests

• Severity: P3. Impact: there is no automated check for the new release-metadata path, so future inconsistencies between .zenodo.json:L3, .zenodo.json:L5, .zenodo.json:L11, CITATION.cff:L2, CITATION.cff:L5, CITATION.cff:L9, and CITATION.cff:L12 would likely be caught only at release time. Concrete fix: add a lightweight metadata smoke test in CI. (support.zenodo.org)

Open questions / assumptions

• This checkout does not include release tags, so I could verify internal consistency only; I could not independently confirm whether CITATION.cff:L11 matches the externally published date of release 3.1.2. This does not change the assessment.