Prepare v0.19.0 release

[stevenboyd78]

Summary

• document daemon compatibility, migration, deployment, systemd supervision, local socket access, destination manifests, transactional SIGHUP reload, upgrades, rollback, and security limits
• use the repository's existing GitHub CodeQL default setup for Actions and Python, removing a redundant advanced workflow that conflicted with default setup
• prepare the 0.19.0 package, runtime, changelog, comparison links, and roadmap metadata

Compatibility

The release preserves:

• the sds200 distribution name
• the sds200 Python import package
• the sdsctl executable
• existing standalone CLI and TUI workflows
• existing scanner and remote-audio profile locations

No configuration is moved, rewritten, or deleted automatically.

Automated validation

• Ruff passed
• MyPy passed for 74 source files
• all 1,267 tests passed on Python 3.14.4
• documentation checks passed for 34 Markdown files
• isolated sdist and wheel builds passed
• Twine checks passed
• wheel and sdist content audits passed
• clean 0.19.0 wheel installation passed
• public PyPI 0.18.0 to local 0.19.0 upgrade passed
• adversarial multiple-client, slow-client, malformed-client, excess-client, and shutdown-fault coverage passed
• targeted daemon-backed TUI regressions passed: 54 tests
• repository CodeQL default setup is configured for Actions and Python
• the pre-correction release head received successful Actions and Python CodeQL analyses with zero findings and no analysis errors

Physical SDS200 validation

Validated with an SDS200 running firmware 1.26.01:

• daemon startup with private 0700 runtime directory and 0600 API, event, and PCMU sockets
• simultaneous API, event, and daemon-owned audio clients
• canonical stream.snapshot event checkpoint
• 200 consecutive PCMU packets and 64,000 samples over eight seconds
• zero stream gaps, queue drops, queue overflows, RTP missing packets, missing samples, or timestamp reversals
• valid 8 kHz mono signed 16-bit daemon-client WAV
• daemon-backed TUI identity, live PSI, automatic playback, manual playback toggling, recording, help, theme switching, and daemon-owned reconnect
• valid 15.120-second 8 kHz mono signed 16-bit TUI WAV with adjacent metadata
• TUI exit left daemon scanner, PSI, audio, and router ownership healthy
• controlled SIGTERM returned success and removed all three sockets
• daemon and TUI logs contained no traceback or ERROR records

Release gate

Merge only after the corrected head passes the full Python 3.11–3.14 CI matrix, package and documentation validation, and the repository's default CodeQL analyses for Actions and Python.