Release pipeline: enforce the version guard on dispatch, clean SBOM, least-privilege jobs (#507)

[kgdunn]

Summary

Fixes #507. Closes the three paths around the ENG-21 (#303) publish gate, plus the smaller hardening items from the same issue. No library code changes; everything is in .github/workflows/publish.yml, Makefile, and the release metadata files.

• Dispatch guard design: the version-vs-tag check now runs on both triggers. On workflow_dispatch the checked-out commit must already carry a v<version> tag matching pyproject.toml, so dispatch becomes a republish-only path (re-run a failed release, re-upload the SBOM). I chose this over a required "expected version" dispatch input because an input only proves the operator typed the same string as the file they are publishing; it does not tie the publish to a deliberate tag on a specific commit. Requiring the existing tag preserves the workflow's stated promise exactly: no tag, no release, regardless of what pyproject.toml holds on the chosen ref. The guard errors also tell the operator what to do (push the tag; dispatch against the tag itself).
• Changelog gate: the build job asserts a matching ## [X.Y.Z] heading exists in CHANGELOG.md (mirroring the extraction regex) and fails before anything is built or published. The notes-extraction step in the publish job now errors instead of silently falling back to --generate-notes.
• Release target commit: gh release create passes --target "$(git rev-parse HEAD)". HEAD of the checkout rather than GITHUB_SHA, because a dispatch run may check out inputs.ref, which differs from github.ref.
• Clean SBOM: the SBOM is generated from a fresh venv containing only the built wheel and its runtime dependency closure; pip/setuptools/wheel are uninstalled from it before the scan, and cyclonedx-bom runs from a separate tooling venv, pointed at the target venv's interpreter. build, cyclonedx-bom, and their transitive deps can no longer appear as components.
• Least-privilege permissions: workflow-level permissions: {}; the build job (which executes repo code via PEP 517 hooks) gets only contents: read; id-token: write, contents: write, and attestations: write stay on the publish job, which also creates the GitHub release (there is no separate release job). The trusted-publishing/OIDC and attestation setup is otherwise untouched, per the issue's non-goals.
• Action pin: pypa/gh-action-pypi-publish is pinned to dc37677b2e1c63e2034f94d8a5b11f265b73ba33, resolved via git ls-remote as the current head of release/v1, which is the peeled commit of tag v1.14.2 (noted in a comment next to the pin).
• Makefile: the release target no longer pulls, builds, or publishes. It prints the tag-gated release instructions (git tag vX.Y.Z && git push origin vX.Y.Z, or workflow_dispatch for a republish) and exits nonzero.

Housekeeping in the same PR: version 1.73.3 in pyproject.toml and CITATION.cff (date-released: 2026-08-29), plus the matching ## [1.73.3] - 2026-08-29 CHANGELOG section and link-footer updates. The version assumes the earlier queued PRs (1.73.x siblings) merge first; their CHANGELOG entries and compare links slot in above/below this one.

Test plan

Full verification needs a real release run (tag push and a dispatch republish); the workflow paths cannot be exercised from CI on this PR. Verified locally:

• python -c "import yaml; yaml.safe_load(open('.github/workflows/publish.yml'))" parses cleanly
• The changelog-guard regex and the extraction regex were both tested against the updated CHANGELOG.md: they match 1.73.3 and 1.71.0, and reject a missing version
• uv run ruff check . and uv run ruff format --check . both pass
• make release now exits nonzero with the instructions

Checklist

• Version bumped in pyproject.toml (PATCH for fixes/docs/config, MINOR for new features)
• Tests added or updated where relevant (not applicable: workflow/Makefile only)
• ruff check . passes
• CHANGELOG.md updated

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[kgdunn]

The typecheck failure here is not this PR's: it is red on main's own latest runs. The unpinned mcp extra now resolves to mcp 2.x, where FastMCP was renamed MCPServer, so mypy fails on src/process_improve/mcp_server.py everywhere. The fix is PR #528; its migrated mcp_server.py and mcp>=2.0 floor are ported verbatim into this branch so CI can go green in any merge order. The ported files disappear from this diff once #528 merges.

---

Generated by Claude Code