release: bring main up to develop (Teller v1.4 → v1.10.3 backport)

[constk]

Summary

Brings the upstream Teller v1.4 → v1.10.3 enhancements onto main. Nine merged PRs back this:

• chore: container hardening — read-only root FS + tmpfs /tmp + Python env #68 (#119, #120, #170) — container hardening: read-only root FS + tmpfs /tmp on docker-compose app; PYTHONDONTWRITEBYTECODE / PYTHONUNBUFFERED env in Dockerfile runtime stage; SECURITY.md distroless-deferral note.
• chore: file/function length caps — ruff PLR0915/PLR0912 + check_file_length.py #69 (#124) — ruff PLR0915/PLR0912 + .github/scripts/check_file_length.py + File length CI job (300-line file cap, 50-statement / 12-branch function caps).
• chore: three CI gates — version bump, action pinning, tests required #70 (#122, #123, #125) — three new CI gates: Version bump check, Action pinning audit, Tests required + 91 unit tests + DEVELOPMENT.md policy sections.
• chore: src/ README audit gate + 5 package READMEs #71 (#126, #152) — src/ README audit CI gate + 5 package READMEs (api, eval, models, observability, tools) with the required ## Key interfaces heading.
• chore: aspirational-ticket gate + INVARIANTS marker convention #72 (#133, #153) — Aspirational ticket cite CI gate + INVARIANTS.md "How to add an invariant" footer; ASPIRATIONAL_STRICT=1 escalator.
• chore: subject-case sync extension — commitizen + pr-title #73 (#128, #154) — Commit-type sync extended with the subject-case axis; commitizen schema_pattern hardened with \s++ possessive quantifier + (?![A-Z][a-z]) lookahead.
• chore: post-release CHANGELOG rollup automation #74 (#150, #166, #167) — post-release CHANGELOG rollup automation: rollup_changelog.py + changelog-rollup.yml workflow + Keep-a-Changelog restructure of CHANGELOG.md.
• test: route-versioning audit + OTel semconv backstop tests #75 (#130, #132, #147) — tests/test_route_versioning.py (5 tests) + tests/test_otel_semconv.py (5 tests) backstops.
• docs: HARNESS_PRIMER + INVARIANTS marker for route-versioning enforcement #76 — docs/HARNESS_PRIMER.md (~600-line non-engineer guide) + INVARIANTS.md invariant 2 promoted to "enforced by tests/test_route_versioning.py".

Net new on develop since last sync

• 7 new .github/scripts/ audits (check_action_pins, check_aspirational_tickets, check_file_length, check_src_readmes, check_tests_present, check_version_bump, rollup_changelog).
• 1 new workflow (changelog-rollup.yml); ci.yml gains 6 new jobs.
• Branch-protection JSONs grew from 15 → 21 required contexts; Branch-protection contexts sync meta-gate green.
• 91 + 18 + 14 + 5 + 5 = 133 new tests, 173 total now passing.
• Coverage: 98.64 % on src/ (gate is 75 %).
• pyproject + uv.lock self-version: 0.1.0 → 0.2.6 across 6 PATCH bumps.

After this lands, the next release tag (v0.3.0 if MINOR-class bumps accumulated, otherwise v0.2.7) cuts cleanly from main. The changelog-rollup.yml workflow will then auto-open a chore: roll up CHANGELOG … PR against develop with the version-heading + footer-link edits.

🤖 Generated with Claude Code