[nir-rs] GH#26 — release: publish 0.4.1 (crates.io + Docker GHCR/Hub + GitHub Release)

[rmems]

GitHub: #26

Summary

Ship nir-rs 0.4.1 as the first full release package:

1. crates.io crate nir-rs = 0.4.1
2. Docker images on GitHub Container Registry (ghcr.io/limen-neural/nir-rs) and Docker Hub ($DOCKER_USER/nir-rs)
3. GitHub Release for tag v0.4.1

Target milestone: v0.4.1 — release hardening

Relationship

• Parent: LIM-822 / GH Epic: pure-Rust NIR (reusable crate + org adoption) #1
• Hardening siblings: chore(ci): run default and hdf5 tests on Linux, macOS, and Windows #27–docs(release): add compatibility matrix and changelog policy #31 (landed)
• Prep on main: PR release: prepare nir-rs 0.4.1 for crates.io #37, git tag v0.4.1
• Pattern: neuromod docker workflow (PR verify vs main publish; dual Hub + GHCR)

Acceptance criteria

crates.io

• Package name available; cargo package / dry-run via release: prepare nir-rs 0.4.1 for crates.io #37
• README badges + CHANGELOG 0.4.1
• cargo publish (needs CARGO_REGISTRY_TOKEN)
• Confirm crates.io + docs.rs

Docker (GitHub + Docker Hub)

• Root Dockerfile (Rust pin + libhdf5-dev; no Python default path)
• .github/workflows/docker.yml:
  • PR: verify build only (contents: read; no packages: write on PRs)
  • main / tag: publish dual registries
• GHCR: ghcr.io/limen-neural/nir-rs
• Docker Hub: ${{ vars.DOCKER_USER }}/nir-rs
• Tags: latest, semver from Cargo.toml, commit SHA
• README pull docs

GitHub tag / Release

• Git tag v0.4.1
• GitHub Release notes for v0.4.1

Secrets / vars

Name	Use
vars.DOCKER_USER	Docker Hub user/org
secrets.DOCKER_PAT	Docker Hub push
GITHUB_TOKEN	GHCR push
CARGO_REGISTRY_TOKEN	crates.io

Non-goals

• Consumer wiring (cross-repo: wire silicon-bridge NIR I/O to depend on nir-rs (org interop — not crate 0.5.0) #15/cross-repo: wire axon-encoder / engram-parser exporters to nir-rs (org interop — not crate 0.5.0) #16)
• New node types
• Publish from every PR

[linear-code]

LIM-996