build: prepare v0.30 release candidates

[MuncleUscles]

Problem and outcome

The v0.30 train uses the layered transaction lifecycle types published in genlayer-py 0.19.0rc1, but its package range and lockfile still selected stable 0.18.0. The repository also had no safe RC route: semantic-release matched only main, the release wrapper accepted unsafe branch/version combinations and missing CI, and tag publication did not verify branch ownership or mark prereleases.

This PR makes the current v0.30-dev head safely releasable as 0.30.0-rc.1 without changing the package version or creating a tag.

Implementation and validation

• require genlayer-py>=0.19.0rc1,<0.20.0; the lockfile resolves exact published 0.19.0rc1
• route RCs only from vX.Y-dev and finals only from vX.Y
• require the exact branch head to have a successful Tests workflow
• compute versions from release history, require an explicit request to match, and add a mutation-free --dry-run
• normalize PEP 440 RC spelling and reject stale/off-branch tags before publishing
• make the publish workflow tag-only, grant only required release contents permission, and mark RC GitHub Releases as prereleases
• add 14 fast release-policy/provenance tests to the native CI matrix

Local evidence on the exact parent v0.30-dev@7d6de26cf0218d599545afb3b01f0c88ee4cafe3:

• Python 3.12: 13 release tests, 70 CLI, 41 gltest, 72 glsim, and 12 direct-runner tests passed
• Python 3.13: 13 release tests, 70 CLI, 41 gltest, 72 glsim, and 12 direct-runner tests passed
• final focused suite after workflow coverage: 14/14 passed
• clean wheel build/install resolved and imported with genlayer-py==0.19.0rc1
• Black, shell syntax, diff whitespace, and lockfile checks passed
• disposable full release-wrapper dry-run computed exactly 0.30.0-rc.1 and created no commit or tag

Release and landing notes

The release remains separate from this PR. After this lands and the exact new v0.30-dev head has green native CI:

scripts/release.sh --dry-run --allow-major 0.30.0-rc.1
scripts/release.sh --allow-major 0.30.0-rc.1

Before the real tag, the protected Publish environment needs a narrow v* tag policy; it currently allows only branch main. The repository-level PYPI_API_TOKEN exists. The environment also has required reviewers, so the exact publish run must follow the authorized release-gate path.

Non-goals: this does not merge promotion PR #92, replace its required final-release E2E gate, include unrelated dependency/Windows/doc PRs, tag, or publish.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 7003b4da-2d5a-4884-93f3-208d9aeb59ed

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}