release: v0.0.0rc0 (dry-run pre-release)

[mlieberman85]

Summary

• Bumps all 4 public packages (darnit-mcp, darnit-core, darnit-baseline, darnit-gittuf) to 0.0.0rc0.
• This is the pre-release that exercises the new tag-driven pipeline end-to-end against TestPyPI + GHCR + GitHub Release before cutting v0.1.0.
• Pre-release rcN tags skip the Homebrew formula bump and Claude Code plugin jobs by design — those run on stable tags only.

Pre-flight (already verified locally on this branch)

• uv sync --all-extras — clean
• uv run ruff check . — All checks passed!
• uv run pytest tests/ --ignore=tests/integration/ -q — 2122 passed, 6 skipped
• uv run python scripts/validate_sync.py --verbose — all validations successful
• uv run python scripts/generate_docs.py then git diff --exit-code docs/generated/ — no diff

External setup still required before tagging

• release environment on kusari-oss/darnit — done (id 15434148958)
• 4× TestPyPI Trusted Publishers (darnit-core, darnit-baseline, darnit-gittuf, darnit-mcp — owner kusari-oss, repo darnit, workflow release.yml, env release)
• Merge this PR
• Tag: git tag v0.0.0rc0 && git push origin v0.0.0rc0

Homebrew tap setup (kusari-oss/homebrew-tap + GitHub App + HOMEBREW_TAP_TOKEN) is not required for rc0 — it's tracked separately as a v0.1.0 blocker.

Test plan

• CI green on this PR
• After tag push: release.yml preflight job passes (verifies tag == pyproject version, working tree clean, lint, tests, sync, docs)
• All 4 pypi_publish_* jobs upload to TestPyPI (not PyPI)
• container_build_push pushes ghcr.io/kusari-oss/darnit:v0.0.0rc0 (+ -rc)
• binary_matrix produces signed shiv binaries for 4 platforms
• release_attach_binaries creates GitHub Release marked pre-release
• homebrew_dispatch and plugin_package skip cleanly (stable-only if: guards)
• finalize posts timing table to release notes
• Release Smoke Tests workflow triggers and passes

🤖 Generated with Claude Code

[Marc-cn]

uv build --package darnit-mcp fails on this branch, the root pyproject has no [build-system], and the build job runs this exact command, so the pipeline will fail at the build step when tagged. The other three packages build fine as 0.0.0rc0.
This fixes it:

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
bypass-selection = true

Happy to push it.

[mlieberman85]

Keeping this open as a tracker through the rc0 dry-run, but not for merge. The version pins to 0.0.0rc0 are dry-run artifacts only — merging into main would block the immediate 0.1.0 bump for the stable release.

Tag will be pushed from release/v0.0.0rc0 directly. Will close this PR once the rc0 → v0.1.0 sequence completes.

[mlieberman85]

uv build --package darnit-mcp fails on this branch, the root pyproject has no [build-system], and the build job runs this exact command, so the pipeline will fail at the build step when tagged. The other three packages build fine as 0.0.0rc0. This fixes it:

[build-system] requires = ["hatchling"] build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel] bypass-selection = true

Happy to push it.

@Marc-cn Thanks for catching this. Absolutely would have hit us on tag push. Can you open a PR against release/v0.0.0rc0 with the fix? Appreciate it.