chore(release): 0.1.0rc1 and 0.1.0-rc.1, the first candidates through the release workflow

[krzysztof-smartdataengines]

Summary

This sets the versions of the first candidates through the release workflow: smart-data-engine-sdk
0.1.0rc1 and @smart-data-engines/sde 0.1.0-rc.1. Nothing is released by merging this. A
release is a tag, pushed by a person, followed by an approval of the deployment.

Why candidates first. The publishing half of release.yml has never run, and it cannot be
rehearsed: tags are immutable and neither registry reuses a number. So the first run spends a number
this project can afford to lose, which is what docs/publishing.md §5 says to do. 0.1.0 follows
after the candidates are verified from the registries.

What pip and npm do with them:

• PyPI. 0.1.0.dev0 < 0.1.0rc1 < 0.1.0 (PEP 440). With no final release, an unpinned
  pip install smart-data-engine-sdk gets 0.1.0rc1, which replaces the development build of
  12 September that predates the starter.
• npm. tools/npm_dist_tag.py (fix(release): npm needs an explicit dist-tag for a prerelease, chosen from what the registry holds #93) gives 0.1.0-rc.1 the latest tag, because no final exists
  and the only version by then is the hand-published 0.1.0-dev.0.

What changed

• python/src/sde/__init__.py, typescript/package.json and its lockfile carry the new versions.
• CHANGELOG.md is new. It covers what these candidates hold since 0.1.0.dev0.
• docs/publishing.md §5.5 is the first release, step by step:
  • the PyPI trusted publisher, and revoking the two tokens from 12 September;
  • the hand-made npm bootstrap of 0.1.0-dev.0 from the bump commit's parent, with
    --tag latest, then npm trust;
  • two-factor authentication for the organisation;
  • the two tags and the deployment approvals;
  • verification from the registries, which is ours;
  • the documents that change only after the publish.
• The package READMEs are the pages PyPI and npm show. They no longer call the Weather starter
  "unreleased": it is in these packages. They say what each package contains, not what a registry
  holds.
• docs/weather-starter.md: the artefact names built from this tree. Its sentence that the starter
  is unreleased stays true until the publish, and changes with the other registry-state documents
  afterwards.

Tests

• The release gate on the tags this is for:
  • tools/release_tag.py accepts refs/tags/python-v0.1.0rc1 and refs/tags/typescript-v0.1.0-rc.1;
  • the wheel, sdist and npm tarball built from git archive of 27be1ef pass
    tools/check_artefact.py at those versions, and twine check --strict passes.
• The installed artefacts:
  • the wheel in a clean Python 3.14.7 environment reports 0.1.0rc1 from site-packages and
    passes all 338 shared conformance tests;
  • the tarball in a Node 26.10.0 application installs with pg, builds a model and ships
    sde-weather-ts.
• make check on the head 27be1ef with both live engines: ruff, mypy, Python 2099 passed and 10
  skipped (the orderbook slice), TypeScript 999 passed.

🤖 Generated with Claude Code