[Mattral]

release: 0.3.1 (version bump, CHANGELOG)

Stacked on #56 (base feat/optional-selector), which is stacked on #55. After those merge, retarget to main. Do not
merge until reviewed. Nothing is tagged or published: that stays with the maintainer, as for 0.3.0.

Changes

• Version 0.3.0 → 0.3.1: pyproject.toml, flashspec/__init__.py, and CITATION.cff (version; date-released
  2026-10-26; change the date if the release is cut on another day).
• Image tag ghcr.io/mattral/flashspec:0.3.1 in the README (install line and server recipe), docs/install.md,
  deploy/docker-compose.yml and the k8s manifest (plus its version label). The build examples in docs/install.md and the
  Dockerfile header comment use FLASHSPEC_VERSION=0.3.1. test_readme.py requires every image reference to equal the
  package version, so these change together.
• README status line: "alpha, version 0.3.1".
• CHANGELOG: [Unreleased] becomes ## [0.3.1] — 2026-10-26 — Optional selector, simpler quickstart, container image,
  with Highlights, Upgrade notes and Known issues. The entries from deploy: publish a GPU-oriented server image to ghcr.io (Dockerfile from PyPI release, container workflow) #53 (container image), docs: simpler quickstart #55 (quickstart) and feat(engine): bandit selector optional #56 (optional
  selector) are its Added/Changed. A new empty [Unreleased] is on top.

Fix included: container workflow on version-bump PRs

The first CI run on this PR had one red check, "build, smoke-test, push". container.yml runs on PRs that touch
deploy/Dockerfile, and this PR changes its build-example comment. The workflow then built the PR's own pyproject version
(0.3.1), which isn't on PyPI until after the release, so it waited 10 minutes and failed. That is a flaw in the workflow from
#53, not in the bump.

Fixed in a separate commit: pull-request builds now test the newest version on PyPI (currently 0.3.0), because the Dockerfile
installs from PyPI anyway. Release and manual runs are unchanged: they still wait for their exact version. Rerun result:
build, smoke test pass, push skipped.

Measurement

None, on purpose. 0.3.1 doesn't change the decoding path: an omitted selector is the same one-arm UCB1 that one-drafter users
already passed. So the README tables stay on the 0.3.0 release run (bundle 3c43e08), and the CHANGELOG says so.

Release order and the image

1. Merge docs: engineering notes #54 (engineering notes; the 0.3.1 Highlights mention docs/lessons.md), docs: simpler quickstart #55, feat(engine): bandit selector optional #56, then this PR.
2. Tag v0.3.1 on the merge commit and run Publish on it (approve pypi).
3. Publish the GitHub release. That triggers container.yml, which waits for PyPI 0.3.1, builds, smoke-tests and pushes
   ghcr.io/mattral/flashspec:0.3.1 and :latest.

Between merging this PR and step 3, the README's docker pull …:0.3.1 line points at a tag that doesn't exist yet. :latest
and :0.3.0 keep working.

Gate

Local, on this branch:

• make lint, mypy --strict flashspec: clean
• pytest tests/unit tests/integration -m "not gpu": 568 passed, 5 skipped (includes the version and image-tag checks)
• python -m build: flashspec-0.3.1.tar.gz, flashspec-0.3.1-py3-none-any.whl
• twine check --strict: wheel PASSED, sdist PASSED
• readme_renderer on the wheel's long description: rendered, no messages, no warnings, no relative link or image
• CI on this PR: build, smoke-test, push pass, docs-build pass, lint pass, onnx-parity pass, paper pass, test-chaos pass, test-cpu pass