docs: release provenance — rust-v0.1.0 retro-tag + version-streams section (LEO-416) (#41)

* docs: release provenance -- rust-v0.1.0 retro-tag note + version-streams section (LEO-416)

The crates.io 0.1.0 publish (2026-07-01) was the one-time manual name-claim
and predated the rust-v release flow, so no tag marked it. An annotated
rust-v0.1.0 tag now points at e47b529 (master at publish time, confirmed
against the crates.io publish timestamps); CONTRIBUTING records why the tag
is retroactive and why a bare tag cannot re-fire publish-crates.yml (it
triggers on published Releases only -- verified: zero workflow runs).

New CONTRIBUTING 'Version streams' section gives 'what version is
sensorwatch?' a documented answer: three deliberately independent streams
(Python 0.2.0, C ABI draft 0.2.0, Rust workspace 0.1.0), parity is
coincidence not contract, no pre-1.0 convergence planned. Records the two
LEO-415 breadcrumbs: the published crates carry unreleased public API
(Snapshot::from_buffer + regenerated sys bindings) so the next crate
release bumps to 0.2.0, and the CLI crate's two outside-crate-root
references block cargo package if it is ever published. CHANGELOG links the
new section; registry badges already landed with LEO-412.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: review round 1 -- correct the cargo-package claim, fix annotated/bare tag wording (LEO-416)

The codex reviewer ran cargo package and disproved the claim that the CLI
crate's two outside-crate-root references block packaging: with a version
on the path dependency, packaging and verify succeed (the e2e module is
cfg(test)-gated, so the verify build never compiles it) -- only the
packaged crate's own tests fail without in-crate copies. CONTRIBUTING,
CHANGELOG, and the originating comment in src/e2e.rs now name the
versionless path-only dependency (a deliberate choice, documented in the
CLI Cargo.toml) plus publish=false as the actual publish preconditions,
and characterize the two copies as packaged-test self-containment. Also
folds in the claude reviewer's precondition nit with the corrected Cargo
claim, and kimi's pointer-to-e2e.rs suggestion.

'Bare git tag' -> 'annotated git tag with no accompanying GitHub Release'
(ambiguous with lightweight tags; flagged by codex and Copilot). The tag
annotation itself carries the same wording and is re-created locally with
the corrected text; pushing the revised tag object rewrites a published
tag, so it awaits the maintainer's explicit go.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: review round 2 -- separate the cargo-package blocker from the publish flag (LEO-416)

Both LGTM reviewers flagged the same conflation: 'the cargo package
blocker is the path dependency plus flipping publish = false' attaches the
flag to packaging, but publish = false gates cargo publish only --
re-verified empirically alongside the round-1 repro (cargo package
succeeds with the flag still set once the path dep has a version, both
outside-root test references untouched). CONTRIBUTING and CHANGELOG now
state: one cargo-package blocker (the deliberately unversioned path
dependency), publish additionally requires the flag flip, and the two
test-resource copies are packaged-test self-containment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>