feat(releases): add Python package evidence profile

[szmyty]

Outcome

Adds Relay's first language-package-specific immutable evidence profile and closes #46.

Changes

• adds the versioned python-package profile for Python packages and independently versioned workspace components;
• adds a closed JSON Schema for component identity, distribution name, semantic version, pyproject.toml authority, sdist, wheels, and registry state;
• binds package metadata, requested release version, distribution filenames, exact artifact hashes, and the complete SHA256SUMS inventory;
• rejects undeclared package artifacts, duplicate declarations, unsafe paths, digest drift, version/name drift, and unsupported metadata shapes;
• limits pre-publication registry truth to external or unavailable, so Relay never implies that PyPI publication occurred;
• records deterministic package evidence and package-specific yank/successor rollback guidance;
• accepts reviewed v0.x.y releases consistently with Aether's explicit pre-1.0 policy.

Workspace boundary

A workspace invokes the profile once per independently versioned Python component. Each bundle names exactly one component and one pyproject-project authority; Relay never guesses a shared workspace version.

Validation

• 160 Python unit/integration tests passed;
• Relay catalog validation passed;
• Python compilation passed;
• 33 JSON contracts and fixtures parsed;
• whitespace validation passed;
• local Ruby YAML parsing was unavailable; GitHub CI runs that required gate.

Rust follow-up

The existing binary profile covers compiled archives but not Cargo crate metadata or registry evidence. #50 tracks the sibling cargo-crate profile without conflating crates with binaries.

Closes #46.

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress