release: 2.3.0

[vyncint]

The production-readiness release.

The half that changes what this product can promise

The lockstep set moves onto reconverge 0.7.0 (#70). Before it, a cluster- or grid-wide barrier under a guard that is only block-uniform produced no findings at all — so the gate this tool is built on could not see that class, and every release up to 2.2.1 shipped with an analyzer that could not. just gate and just prune were both re-run at the new set: same verdicts, including reduce-flip's 3 clean / 8 refused.

The measurement path, which was the least tested code here

#72	launchbound-runner read --budget-secs 30m as no budget — the spelling tune --budget takes — on the machine the whole stage/ship/run split exists to keep cheap. One parser now, shared with the CLI, which had all of this right already
#81 #82	94 → 123 tests. The exit-code contract, checkpoint/resume, the Metal path, the model's ranking. CI executes a real Metal dispatch on macos-latest now
#83	a dispatch-only gpu.yml that re-runs the CUDA path — written, not yet exercised, and the issue stays open for that

The release process, which had let one slip

#74 — release.yml had no gh release step at all, so 2.2.1 sat on crates.io for twelve days while the repository showed 2.2.0 as Latest, for the release whose whole content was making the README links work. #75 — the semver baseline was a release behind, against its own written rule; check-versions.sh now holds it to the index.

Supply chain and contributor surface

#76–#79: every action a SHA, every job capped from measured durations, credentials not persisted, dependabot on both ecosystems, and a zizmor job auditing online — which earned its place on the first run by finding a pin whose # v1 comment no longer described it. #80: three issue forms that ask for the provenance a result here depends on, a PR template, CODEOWNERS.

Documentation

#73 — docs/LIMITATIONS.md contradicted itself about the T4 and claimed a hardware validation that never happened, in the file the README tells you to read before trusting a result.

Gate

cargo test --workspace 0 failures, clippy and rustdoc clean at -D warnings, cargo deny ok on all four, and check-pins, check-versions, links, schemas and skill all green.