Adopt research-repo-tools v0.2.3 and assess validated artifact promotion #298

Summary

Adopt the published research-repo-tools v0.2.3 updater and record whether trusted main-artifact promotion applies to this repository. Tracking: acgetchell/research-repo-tools#122. Depends on verified publication in acgetchell/research-repo-tools#124; the wider tracker stays open during adoption.

Current State

Main now pins published research-repo-tools 0.2.3 via PR #299, initially prepared as a draft at fae5c9e. GitHub records acgetchell later making it ready, enabling auto-merge, and merging as 719003f; the agent issued none of those operations. Both commits have the same source tree. The real updater and 107 consumer tests passed. Full PR Linux/macOS/Windows CI, Python/Cargo audits, CodeQL, Clippy security, zizmor, coverage and rule analysis passed; CodeRabbit approved the head. Semgrep 1.182.0, separate Python 3.14, MCP override and certifi fix remain intact. Upstream publication prerequisite acgetchell/research-repo-tools#124 is complete.

Post-merge checkpoint verified: CI run 39697996232, attempt 1 completed successfully for the main push at 719003f. Linux, macOS, and Windows each passed Run CI checks. This completes the v0.2.3 adoption. Broader Rust release-evidence reuse is being implemented and reviewed separately as part of the maintainer-requested v0.5.1 repository review.

Proposed Changes

• Retain the certifi security fix, Semgrep==1.182.0, Python >=3.14,<3.15 and its 3.14 selector, no-build-package policy, and mcp>=1.30.0,<2 override. Published Semgrep 1.182.0 metadata still requires mcp==1.29.0. Validate the actual installed registry package and real shared updater, Semgrep production scan and fixtures, security and focused repository checks. Open or update a DRAFT adoption PR; do not merge it.
• Preserve Cargo package verification, benchmark freshness and immutable Criterion baseline/provenance, required native checks, crates.io deployment approval and release instructions. This task does not authorize adopting Python wheel/sdist release logic for the Rust crate.
• Review docs/RELEASING.md and workflow commands together so manual instructions match the final native flow.
• Record exact package/version/artifact identities, preserved overrides and environments, focused local checks and required hosted CI results in the adoption PR.
• No committed local-wheel paths, editable sibling packages or temporary source overrides; do not publish throwaway packages or overwrite released artifacts.

Benefits

A normal just update refreshes the root and explicitly declared independent projects while retaining each environment's contract. Any release-time artifact reuse has explicit evidence and preserves repository-specific gates.

Implementation Notes

This is separate consumer work and does not delay upstream v0.2.3 publication. Use the public selection/immutable retrieval primitives only where appropriate; design and review native artifact production, validation and promotion before changing Rust release workflows. The current task completes this adoption after publication; broader release-artifact reuse may be separately scoped.