chore(release): licence, MSRV, packaging and CI gates for 0.1.0

[OpenSauce]

Last PR before cargo publish. Everything needed to release, nothing else.

The blocker

LICENSE did not exist. Cargo.toml has declared license = "MIT" since the first commit while no licence text shipped — so the copyright notice MIT requires was missing from both the repo and the crate. Body is byte-identical to nam-rs's.

Packaging

• rust-version = "1.86" — without it, a user on an older toolchain gets a wall of edition-2024 syntax errors instead of cargo's requires rustc 1.86 message. The floor comes from url → idna_adapter → icu_*, not from our code.
• exclude = [".github/", "scripts/", "Makefile", "CLAUDE.md", "docs/"]. CLAUDE.md in particular referenced gitignored design docs a consumer will never have. tests/ and examples/ stay — they're documentation. Tarball is 42 files, 206.6KiB (56.3KiB compressed).
• Cargo.lock is now committed. It binds nothing downstream for a library, but it makes CI reproducible under --locked and gives Dependabot something to update.

Dependabot

Cargo and github-actions, weekly. Minor and patch grouped into one PR; majors arrive individually so they actually get read. This is precisely the gap that let reqwest 0.13 sit unnoticed for eight months.

Three new CI jobs

Job	Why
docs — cargo doc with -D warnings	Not hygiene. docs.rs builds with these lints, and the broken intra-doc link caught in #13's review would have published 0.1.0 with a red "build failed" page and no documentation at all.
package — cargo publish --dry-run	Packaging breaks on a PR, not on release day.
msrv — pinned to 1.86	A declared MSRV with nothing enforcing it rots silently. Library only: wiremock 0.6 itself needs 1.88, and dev-dependencies aren't what a consumer compiles.

cargo test also runs --locked now.

CHANGELOG

Hand-written for this release; git-cliff can take over at 0.2.0 once the release shape is known. It records the three things that will otherwise surprise people: no anonymous access, models() serving one architecture at a time, and models_count meaning different things on different endpoints.

Verification

Ran every CI job locally: cargo fmt --check, clippy --all-targets --all-features -D warnings, cargo test --all-features --locked (70 passing), cargo doc with RUSTDOCFLAGS=-D warnings, cargo +1.86 check --locked, and cargo publish --dry-run --locked — which packaged and compiled the crate standalone.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Prepares tone3000-rs for the 0.1.0 crates.io release by adding required licensing, tightening packaging metadata, and introducing CI/Dependabot gates that make release readiness and MSRV enforceable.

Changes:

• Add MIT LICENSE and a first-release CHANGELOG.md.
• Declare MSRV (rust-version = "1.86"), commit Cargo.lock, and trim the published crate contents via exclude.
• Add CI jobs for docs (rustdoc warnings as errors), packaging (cargo publish --dry-run), and MSRV checking; add weekly Dependabot updates.

Reviewed changes

Copilot reviewed 5 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
LICENSE	Adds MIT license text required for publishing.
CHANGELOG.md	Introduces a 0.1.0 changelog entry and release links.
Cargo.toml	Declares MSRV, adds publish excludes, and keeps release metadata consistent.
Cargo.lock	Commits a lockfile to enable reproducible CI via --locked.
.gitignore	Stops ignoring Cargo.lock so it can be committed.
.github/workflows/ci.yml	Adds docs/package/MSRV CI gates and runs tests with --locked.
.github/dependabot.yml	Configures weekly Dependabot updates (cargo + GitHub Actions).

Suppressed comments (1)

.github/workflows/ci.yml:27

• cargo doc should also run with --locked to ensure docs builds use the committed Cargo.lock (matching cargo test --locked / cargo publish --dry-run --locked) and to prevent lockfile drift being masked in CI.

      - uses: dtolnay/rust-toolchain@stable
      - run: cargo doc --no-deps --all-features
        env:
          RUSTDOCFLAGS: -D warnings

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.