Release v0.2.0 (honest beta) and define v1.0 exit criteria

[jeremymanning]

Part of #108 · Phase 7

Goal

Cut a release whose claims are all true, then define what v1.0 requires.

v0.2.0 — "honest beta"

The point is not new features. It is that the package's advertised surface equals its working surface.

• Version unified across all four locations (see the docs issue); setup.py removed in favor of pyproject.toml
• README.md describes only what is verified working, with every example executed in CI
• Backends are labelled by real status: supported (tested end to end in CI) / experimental (works, thinly tested) / unsupported (removed from the docs, or removed from the code)
• NotImplementedError does not exist on any advertised path
• CHANGELOG written from the actual audit findings, stating plainly what was broken and is now fixed
• requires-python raised to a supported floor; classifiers match the tested matrix
• Clean pip install clustrix in a fresh venv -> the README quickstart runs to completion
• TestPyPI upload verified before the real one
• ReadTheDocs builds green; docs/source/conf.py version matches the release
• Git tag + GitHub release

v1.0.0 exit criteria

Inherited from #108, restated here as the release gate. All must hold:

1. pip install -e ".[dev]" on a clean machine, then the documented test command, runs the suite to completion — with zero network calls to billable services
2. CI executes >95% of the test suite on every PR; no continue-on-error anywhere
3. Zero failing tests, zero collection errors
4. unittest.mock appears zero times in clustrix/
5. Every backend claimed in README.md has a test that actually executed it end to end, with a dated CI run link as evidence
6. Coverage measured, published, and gated at a threshold the project meets, ratcheting upward only
7. Every README.md example executed by a doc test in CI
8. One source of truth for the version
9. Secret scanning + push protection enabled; no plaintext credential ever written world-readable
10. The remote->local trust boundary documented and either authenticated or explicitly opt-in
11. Red-team report complete, findings resolved with regression tests

Deliberately not in scope

Feature work. The audit found ~5,100 lines of orphaned modules and four broken backends; the fastest route to a credible v1.0 is subtraction, not addition. New backends and the widget re-platform proposed in #67 belong after 1.0.

[jeremymanning]

Tracked as a sub-issue of #160 (deferred). Consolidated after a three-agent audit that verified every open issue against the code; see #160 for the plan and the ordering.