v0.4.1
What's changed
- Add Python 3.10, 3.11, and 3.12 CI coverage using normal package installs.
- Add checked wheel and source-distribution builds.
- Add release-triggered PyPI Trusted Publishing with OIDC.
Proof boundary
This release improves package distribution and release automation. Hashes, manifests, sandbox checks, and signed sidecars retain the documented proof boundaries; they do not by themselves prove artifact semantics or signer identity.