Release boundver 0.10.0

[yzm1]

Summary

• replace ambiguous v1 fingerprint framing with domain-separated, length-prefixed v2 hashing and deterministic boundary-lock/v2 lockfiles
• fail closed across Git/source selection, malformed input, partial updates, provider metadata, configured paths, versions, symlinks, and custom provider loading
• add facet gates, behavior drift, consumers, glob contracts, severity exit codes, verify --update, changed-path reporting, and atomic writes
• publish one hardened composite Action with structured inputs and add verified tag/PyPI/GitHub-release sequencing
• rewrite onboarding/CI/examples, improve PyPI metadata and community files, and record every finding in docs/PROJECT_REVIEW.md

Breaking change

v1 fingerprints cannot be safely migrated because their framing was ambiguous. Users must regenerate locks with boundver 0.10.0.

Verification

• 834/834 unit and integration tests passed locally in four balanced shards
• all root/example v2 lockfiles reproduced from the exact candidate and passed all four facets
• exact Git tree published remotely matches local tree 61ad127e6ef93787fd59ead25b6a32ff77beefa6
• wheel/sdist built from the exact candidate; runtime schema, type marker, specs, policies, tests, and audit record were present
• extracted wheel passed python -m boundver, validation, generation, verification, and status in an unrelated Git repository
• final bounded security and release-candidate audits returned PASS

Release gate

Keep this PR draft until the complete Python 3.9–3.14 Linux/Windows matrix, package smoke job, and public Action contract job are green. After merge, tag v0.10.0; the publish workflow verifies and publishes the same artifacts, creates the GitHub Release, and advances stable tag v0.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8fca224ee7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject vendored copies absent from the selected snapshot

When using --source head or index, this existence check is skipped entirely; in working-tree mode it accepts an on-disk but untracked copy even though hashing enumerates tracked files only. In either case _content_only_digest() returns None, generation succeeds and writes that null into vendored_digests, but the newly generated lockfile is immediately rejected by _lockfile_structure_issues() and the v2 schema, which require string digest values. Validate the copy against the selected Git snapshot or treat a missing digest as a generation error.

Useful? React with 👍 / 👎.