[dduugg]

Summary

• Bumps Cargo.toml from 0.4.0 to 0.5.0. Tolerate recorded violations in strict mode (Part B of #43) #45's strict-mode change is breaking, and pre-1.0 that wants a minor bump rather than 0.4.x.
• Restores the DotSlash pks file on releases. Add cargo-dist for automated binary distribution #33 dropped the job that published it when it moved releases to cargo-dist. It's back as publish-dotslash.yml, a reusable workflow that dist calls after the release is announced (post-announce-jobs), with dotslash-config.json updated for cargo-dist's asset names and Windows added.
• Rewrites INSTALLATION.md for the cargo-dist release artifacts, and corrects cargo install pks, which installs the original alexevanczuk/packs crate (0.2.40) from crates.io, not this repository.
• Retitles ## Unreleased to ## 0.5.0 in CHANGELOG.md and adds entries for the other user-visible changes since v0.4.0 (Match recorded violations in strict packs (Part A) #43, Remove stray dbg! from the privacy checker #50, Compile inflector regexes once instead of per call #54, and the cargo-dist switch from Add cargo-dist for automated binary distribution #33).

Before marking ready

• Match recorded violations in strict packs (Part A) #43 and Tolerate recorded violations in strict mode (Part B of #43) #45 are merged.
• Merge main into this branch. In CHANGELOG.md, retitle ## Unreleased to ## 0.5.0, and remove the "Whoever cuts the next release" comment Tolerate recorded violations in strict mode (Part B of #43) #45 adds. cargo-dist builds the GitHub Release notes by matching a heading against the tag, so an entry left under ## Unreleased silently misses the release notes.
• Add the remaining entries. Skip reading source files on a warm cache hit via mtime + length #59 isn't merged, so it's not included; add an entry if it lands first.
• Decide what to do about dotslash: restored (see below).

After merge

• Push the v0.5.0 tag on the merge commit. .github/workflows/release.yml runs on the tag push: it builds six targets and publishes the GitHub Release with the installers. Nothing is published to crates.io.
• Check the release assets, including the pks DotSlash file, and run the shell installer once.
• If custom-publish-dotslash fails after uploading pks and needs a re-run, delete the asset first (gh release delete-asset v0.5.0 pks --yes). The action uploads without --clobber.

Worth knowing before tagging

• This will be the first release through cargo-dist. v0.4.0 was cut by the old ci.yml release job, which Add cargo-dist for automated binary distribution #33 replaced, and release.yml has never run on a tag. On PRs it only runs the plan job, so the six-target build matrix has never been exercised. To try it before tagging, set cargo-dist's pr-run-mode = "upload" on this branch.
• The asset names change. v0.4.0 shipped pks, pks-mac.tar.gz, x86_64-unknown-linux-gnu.tar.gz and aarch64-unknown-linux-gnu.tar.gz. cargo-dist ships pks-<target>.tar.xz (a .zip on Windows), pks-installer.sh, pks-installer.ps1, sha256.sum and source.tar.gz. Anything that downloads assets by their old names will break.
• How the DotSlash file is published. It can't be a separate on: release workflow, because dist creates the release with GITHUB_TOKEN and events from GITHUB_TOKEN don't trigger other workflows. So dist calls publish-dotslash.yml as a custom job, and release.yml is regenerated with dist generate (the only change is the added call). The action reads dotslash-config.json through the API at the tagged commit. The tarballs put the binary at pks-<target>/pks and the Windows zip is flat, which is what the config's path values reflect. zizmor's secrets-inherit and self-repository findings come from dist's template for the call, so they're ignored for release.yml like the existing ones.

Release notes preview

The plan job on this PR's Release run builds the manifest cargo-dist will publish from. It has announcement_tag v0.5.0 and a GitHub Release body made up of the whole ## 0.5.0 section (Breaking Changes, Fixes, Performance, Distribution, Internal), then cargo-dist's install and download sections, and nothing from 0.4.0.

Test plan

• DotSlash, end to end on macOS arm64: ran the action's process_config.py (at the pinned commit) against a real cargo-dist archive built with dist build, then ran the generated file with dotslash 0.5.9. It fetched the archive, verified the blake3 digest, and printed pks 0.5.0.

• dist generate is idempotent, dist plan gives tag v0.5.0, and zizmor and actionlint are clean.

• cargo test (the pre-commit hook), 266 passed.

• CI passes.

• After tagging, the Release workflow publishes v0.5.0 with the assets listed above.