anaf-sync 0.2.4 — releases that explain themselves

Maintenance release: one visible fix, and the release process behind it.

Fix

anaf-sync --version reports the version you actually installed. The
version is declared twice — in pyproject.toml and as anaf_sync.__version__
— and v0.2.3 bumped only the first, so every 0.2.3 install answered
anaf-sync 0.2.2. The two are aligned again, and a test now fails the suite
the moment they disagree, which is the only reliable way to notice: a half-done
bump changes nothing else that anyone looks at.

Release process

Every release carries written notes from now on, and the old ones got theirs
retroactively. The prose lives in release-notes/ in the repository, one
file per tag, backfilled to v0.1.0 — including the four tags (v0.1.0, v0.1.2,
v0.1.3, v0.1.4) that were published to PyPI but never got a GitHub release at
all, and v0.2.3, whose release came out with an empty body.

That gap had a single cause: nothing in the release workflow created a release.
The one job that made one was the tray bundle upload, which has no notes to
give. A v* tag now publishes to PyPI first and creates the release
second — the release is the announcement, so it should never point at a
version pip install cannot reach yet — with the sdist, the wheel, and all
three tray bundles attached to that one release. PyPI's project page links out
to the releases, so the notes have one home.

Internal

• Dependency floor raised to anafpy 0.6.0. Nothing between 0.5.2 and 0.6.0
  touches the surface anaf-sync uses (auth, e-Factura, exceptions, public
  services) — those releases land DUKIntegrator self-install, a reverse-charge
  authoring fix, and Windows declaration signing. The one change worth naming
  is 0.5.3 moving ServerConfig misconfiguration off pydantic's
  ValidationError and onto AnafConfigError, which config.py already
  catches.
• CI reports JUnit test results to Codecov alongside coverage, per matrix
  leg, so a flaky test stays attributable to an OS and a Python version. The
  upload runs even on a red run — that is precisely the run whose results are
  worth reading.

⚠️ The bundles are unsigned — no macOS notarization, no Windows
Authenticode. First run triggers the usual OS warning; use the
right-click-open workaround documented in the README. The CLI on PyPI
(pip install anaf-sync) is unaffected.

Full changelog: v0.2.3...v0.2.4