v0.2.2

Added

• CHANGELOG.md, with sections for every published version (#52).
• release.yml creates a GitHub Release for each v* tag once the version is on PyPI (#52).
  Release notes come from that version's section in this file, and a missing section fails the job.
  The built wheel and sdist are attached. Re-running the job updates the existing Release instead
  of failing. Tags containing -, rc, a<n> or b<n> become pre-releases.

Security

• The Docker image no longer trusts emSign ECC Root CA - G3 after the eMudhra/emSign
  certificate incident
  (details).
  uv is pinned to 0.13.5 instead of :latest, because a cached :latest can still be a
  pre-0.13.4 digest. The system CA bundle, which urllib callers such as the ComfyUI backend use,
  disables emSign ECC Root CA - G3 and the Comodo AAA cross-sign root. The image installs pip 26.2.2
  (hash-pinned) and certifi>=2026.10.19.
• certifi>=2026.10.19 is pinned in the dev extra.