[P1] Harden release, versioning, CI, and supply chain #7

Phase 7 of the v0.5.0 hardening roadmap.

Scope:

• single-source package version;
• synchronize Python classifiers and CI support matrix;
• test current stable Python releases and use prerelease compatibility signal where appropriate;
• build wheel/sdist once after quality/eval gates;
• publish exact artifacts through PyPI Trusted Publishing/OIDC;
• attach the same artifacts to GitHub Release;
• generate artifact provenance/attestation where supported;
• update deprecated GitHub Actions;
• consider full-SHA pinning for third-party Actions;
• add Dependabot (or equivalent);
• add CodeQL;
• add dependency review where supported;
• evaluate OpenSSF Scorecard as an actionable signal;
• document arbitrary catalog URL / SSRF trust boundary for hosted use.

Acceptance: tag, package metadata, wheel/sdist, GitHub Release, and provenance all describe the same release artifact set.

Repository-side verification — 2026-09-20

• PR chore: harden v0.5.0 release and supply chain #19 merged release/supply-chain hardening.
• PR ci: make v0.5.0 release branch self-create tag #23 merged a release-branch trigger that can create the immutable tag after PyPI succeeds.
• Python 3.12, 3.13, and 3.14 full CI passed.
• Python 3.15.0rc2 compatibility signal reached dependency installation and failed building Shapely 2.1.2 from source due missing NumPy headers; this job is intentionally non-blocking.
• CodeQL v4 completed successfully.
• Dependency Review workflow is present but currently cannot run until GitHub Dependency graph is enabled for the repository.
• Remaining acceptance work: enable Dependency graph; configure the PyPI Trusted Publisher; execute the v0.5.0 release so PyPI, tag, GitHub Release, checksums, and attestations can be verified as one artifact set.

Current external blocker

PyPI OIDC has been attempted twice from the real release workflow and both attempts returned
invalid-publisher. The GitHub OIDC claims are valid and stable:

• repository: GeoGeekLab/stac-scout
• workflow: release.yml
• environment: pypi
• release ref: release/v0.5.0

This confirms the remaining fault is the missing/mismatched PyPI Trusted Publisher registration,
not the build or GitHub OIDC configuration.

PR #25 adds a clean-PyPI-install + README-first-success smoke gate before tag/GitHub Release.

Final verification

• PyPI Trusted Publishing succeeded from the release workflow.
• Clean Python 3.14 install of stac-scout==0.5.0 from PyPI succeeded.
• README first-success smoke path succeeded from the installed PyPI package.
• Dependency Review succeeded after enabling Dependency graph.
• The exact successful release artifact set was checksum-verified and attached to GitHub Release v0.5.0.
• GitHub Release contains wheel, sdist, and SHA256SUMS, targeting release commit b0541b8fe631a6bd7a44e52e45696e759061074f.
• The normal release workflow was fixed to checkout before release finalization.