release: v0.0.0rc0 (dry-run pre-release)

[mlieberman85]

Summary

• Bumps all 4 public packages (darnit-mcp, darnit-core, darnit-baseline, darnit-gittuf) to 0.0.0rc0.
• This is the pre-release that exercises the new tag-driven pipeline end-to-end against TestPyPI + GHCR + GitHub Release before cutting v0.1.0.
• Pre-release rcN tags skip the Homebrew formula bump and Claude Code plugin jobs by design — those run on stable tags only.

Pre-flight (already verified locally on this branch)

• uv sync --all-extras — clean
• uv run ruff check . — All checks passed!
• uv run pytest tests/ --ignore=tests/integration/ -q — 2122 passed, 6 skipped
• uv run python scripts/validate_sync.py --verbose — all validations successful
• uv run python scripts/generate_docs.py then git diff --exit-code docs/generated/ — no diff

External setup still required before tagging

• release environment on kusari-oss/darnit — done (id 15434148958)
• 4× TestPyPI Trusted Publishers (darnit-core, darnit-baseline, darnit-gittuf, darnit-mcp — owner kusari-oss, repo darnit, workflow release.yml, env release)
• Merge this PR
• Tag: git tag v0.0.0rc0 && git push origin v0.0.0rc0

Homebrew tap setup (kusari-oss/homebrew-tap + GitHub App + HOMEBREW_TAP_TOKEN) is not required for rc0 — it's tracked separately as a v0.1.0 blocker.

Test plan

• CI green on this PR
• After tag push: release.yml preflight job passes (verifies tag == pyproject version, working tree clean, lint, tests, sync, docs)
• All 4 pypi_publish_* jobs upload to TestPyPI (not PyPI)
• container_build_push pushes ghcr.io/kusari-oss/darnit:v0.0.0rc0 (+ -rc)
• binary_matrix produces signed shiv binaries for 4 platforms
• release_attach_binaries creates GitHub Release marked pre-release
• homebrew_dispatch and plugin_package skip cleanly (stable-only if: guards)
• finalize posts timing table to release notes
• Release Smoke Tests workflow triggers and passes

🤖 Generated with Claude Code