Split lightweight conformance from simulator facade

[Taz33m]

Summary

• Make tracebook-conformance==0.6.0 the sole owner of the tracebook package, bundled fixtures, typing marker, and conformance command, with no mandatory runtime dependencies.
• Replace tracebook-sim==0.6.0 with a package-less compatibility facade that pins the exact conformance version, retains NumPy/psutil, and preserves the seven existing simulator/workbench commands.
• Document the required uninstall-first handoff from monolithic tracebook-sim 0.5.x before either 0.6.0 install, including a recovery command for damaged direct upgrades.
• Build, validate, and publish both distributions in dependency order, with disjoint ownership, sdist/wheel agreement, deterministic wheel rebuilds, and public-index SHA verification.
• Keep the adoption loop narrow: Tracebook discovers, localizes, and reduces; maintainers review native regressions; adapter/CI ownership remains opt-in after demonstrated value. This PR does not expand the separate native review unit.

Why

Conformance qualification does not need NumPy or psutil, but Python extras cannot remove mandatory dependencies. A separate package-less facade preserves the existing simulator experience without creating overlapping installed files.

The 0.5.x wheel owned the entire tracebook namespace. A naive in-place upgrade can install the new owner and then delete its files while uninstalling the old owner, so the supported migration must uninstall 0.5.x first.

Validation

• 389 tests passed with 81.49% coverage; no skips or warnings.
• Black, Flake8, mypy, Bandit, compileall, and the 6/6 system smoke passed.
• Both workflow files parsed without duplicate keys; all shell blocks, Python heredocs, and inline Python compiled.
• Both wheels and sdists passed Twine; direct wheels were byte-for-byte reproducible under the same commit-derived epoch.
• Both sdists rebuilt to wheels matching every logical member path and byte.
• The split verifier passed disjoint RECORD/entry-point ownership, both uninstall orders, the SHA-256-pinned public 0.5.0 migration, a normal resolver install, pip check, and all seven facade command probes.
• The isolated conformance wheel passed 3/3 fixed cases, 25/25 generated traces, 5,000 events, and 10/10 semantic capabilities with neither NumPy nor psutil installed.

Merge and release blocker

Keep this PR in draft and do not merge yet.

tracebook-conformance is a new PyPI project name and is not currently published. Before merge/release:

1. Configure its pending PyPI Trusted Publisher for Taz33m/tracebook, workflow release.yml, environment pypi.
2. Prepare the immediate 0.6.0 release path so main does not advertise an unavailable pinned package.
3. In the final release commit, update CITATION.cff to 0.6.0 and its conformance PyPI URL, and mark 0.6.x supported in SECURITY.md.

The release workflow intentionally rejects a v0.6.0 release until that final public metadata is truthful.

---

Summary by cubic

Split the project into tracebook-conformance (owns the tracebook package and conformance command with zero mandatory runtime deps) and a package-less tracebook-sim facade for simulator/workbench commands; hardened the 0.6.0 release with deterministic, verifiable builds and updated docs to point to the new distribution.

• New Features

  • Completed packaging split: root renamed to tracebook-conformance (empty deps); added packaging/tracebook-sim facade with the seven simulator/workbench commands and its own pyproject.toml/LICENSE.
  • Hardened CI/release for reproducible, verifiable builds: pin setuptools/wheel, set SOURCE_DATE_EPOCH from the release commit, install conformance and facade separately, isolate the conformance smoke by clearing Python env vars and disabling user site, and add gates/tests for disjoint ownership and byte-for-byte sdist→wheel agreement via tools/verify_distribution_split.py and tools/verify_sdist_wheel_agreement.py.
  • Finalized 0.6.0: updated badges to tracebook-conformance, CHANGELOG, CITATION.cff (version/date/URL), SECURITY.md (0.6.x), added docs/releases/0.6.0.md, refreshed qualification IDs/corpus hashes, and aligned examples and docs.

• Migration

  • If upgrading from tracebook-sim 0.5.x, uninstall it first: python -m pip uninstall -y tracebook-sim.
  • Install qualification and the core API: python -m pip install "tracebook-conformance==0.6.0". Add simulator/workbench tools if needed: python -m pip install "tracebook-sim==0.6.0".

^{Written for commit 23b7be2. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 39 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>