chore: publish readiness — license, tag-derived version, honest spot-checks

[inth3shadows]

Prep for taking the repo public. Plan: ~/.claude/plans/testgraph-public-release.md.
No behavior change to selection. Ran 264 tests, OK.

Suspend the append spot-check instead of letting it lie

Its floor (min_caller_edges: 5) passes today on 7 edges that codegraph's Python
resolver fabricates (#66) — not one from a real caller. So it asserts an integrity
guarantee the index cannot keep, and a commit breaking ledger.append (the sole write
path for J1 and J5) would sail straight past it.

The registry note already described this in prose; nothing machine-readable acted on
it. integrity.check now honors an optional suspended: "<reason>" on a spot-check
spec — skip the floor, emit a warning naming the symbol and why. Chosen over deleting
the check, which would have taken the reason with it.

Re-verified against a 4-file repro on 2026-09-03: the bug is live in codegraph 1.5.0
and in 1.6.0, the current npm latest. The fix exists on a fork branch
(fix/python-module-member-builtin-collision, 7ecf6dc) and has never been PR'd
upstream — so #66 stays open, and the disclosure ships with the artifact.

Two tests pin it: a suspended check warns rather than passing silently, and a
blank/whitespace reason does not disarm it — otherwise a stray key quietly disables
the one check codegraph sync cannot clear.

pyproject.toml + hatch-vcs — the git tag becomes the version

Replaces __version__ = "0.1.0-spike", written during the Phase 1 spike and never
updated since, with the generated file falling back to importlib.metadata, then
0+unknown — never a stale number. dependencies = [] asserts the stdlib-only claim
where a resolver checks it. The wheel ships testgraph/ alone; harness/, hooks/ and
skills/ are repo artifacts with no import contract.

Deliberately no [project.scripts]. Every CLI is documented and journey-registered
as python3 -m testgraph.<module> (J1–J5); a second interface whose drift nothing checks
should be a decision, not a packaging side effect.

Verified end to end: tag v0.1.0 → uv build → testgraph-0.1.0-py3-none-any.whl, and
the release workflow's version assert passes on it.

.gitignore: .codegraph/ → .codegraph

A trailing slash matches directories only, so the claudew worktree's .codegraph
symlink was never ignored and left the tree permanently dirty. That blocks
repo-publish (it refuses an unclean tree) on any worktree of any codegraph-indexed
repo — not just this one.

LICENSE

MIT, matching the rest of the portfolio.

---

Next: the repo-publish scaffold PR (release workflow), then --finalize v0.1.0.