chore(main): release 2.2.1

[github-actions]

🤖 I have created a release beep boop

2.2.1 (2026-09-01)

⚠ BREAKING CHANGES

• reading values are float | None; the [mysql] extra and aemo_mdff_reader.sql (QueryBuilder, Storer) are removed; files with over-long 300 rows, non-numeric values, impossible dates or out-of-range 400 bounds now raise NEM12ParseError where they previously parsed.
• minimum Python version is now 3.12. Users on 3.11 should pin to aemo-mdff-reader<2.3.
• minimum Python version is now 3.11. Users on 3.10 should pin to aemo-mdff-reader<2.2.

Features

• drop Python 3.10, bump dev floor to pandas 3 / numpy 2.x (876c863)
• drop Python 3.11 support (#70) (383ff6d)
• drop Python 3.9, hash-pin CI installs, scope release-please permissions (447ec98)

Bug Fixes

• changed quality method on interval event record to NOTREQUIRED (dc75bc2)
• ci: use renamed package in coverage flag, smoke step, bandit scope (e96c582)
• fuzz: install with --ignore-requires-python on the 3.11 OSS-Fuzz image (#75) (28605fe)
• release-please dispatch + SBOM directory creation (#17) (8e3cd13)
• rename release-please config to default path (#15) (843d25f)
• tolerate unparseable 100-record DateTime instead of failing the file (#73) (ec84dd9), closes #72
• v4 correctness pass — truncated 300 rows, missing-vs-zero readings, typed errors, dead sql removal (#111) (5079858)

Documentation

• add SECURITY.md disclosure policy (cca1eb0)
• bake CI hardening into a 2.2.1 release (7798a08)
• remove broken OpenSSF Best Practices badge (#21) (91a68d5)

---

This PR was generated with Release Please. See documentation.

[cohenrobinson]

Closing: this PR would downgrade 4.0.0 → 2.2.1. The v4.0.0 tag/release was missing (4.0.0 landed via #111), so release-please rescanned history and honoured a stale Release-As: 2.2.1 footer. v4.0.0 is now tagged/released at the #111 merge commit; release-please will compute correctly from here.