v0.5.0

[waterflane]

Summary

v0.5: Generic local integration bridge (release prepared)

• Expose immutable model-free candidate, expansion, verified-read, and
  package application contracts without changing model-assisted discovery.
• Add a persistent workspace-bound JSON-RPC 2.0 bridge over UTF-8 NDJSON
  stdio with explicit protocol v1 negotiation and cancellation.
• Keep repository truth, source identity verification, path policy, and
  read-only guarantees inside ContextForge while consumers own model selection.
• Keep MCP independent and preserve its existing read-only protocol.

Type of change

• Bug fix
• Feature
• Documentation
• Refactor or maintenance
• Security hardening without vulnerability details

Validation

• ruff format --check .
• ruff check .
• mypy
• pytest
• Documentation/package checks, when applicable
• Checks did not require a live local or remote model provider

Contributor confirmation

• This pull request targets dev (unless the maintainer requested
  otherwise).
• I have the right to submit this contribution under Apache-2.0 as
  described in CONTRIBUTING.md.
• I did not include credentials, private source, prompts, or unsanitized
  logs.
• New dependencies or copied assets include compatible provenance and
  licensing information.