[codex] Prepare v0.4.4 release

[senseibelbi]

Summary

• prepare the 0.4.4 release surface and align all version markers
• consolidate the retained public preflight into the Model Smoke workflow and keep its evidence artifacts
• fix async release-readiness tracking and source-overlay contract drift so live and local contract bundles stay aligned

Details

• bump package, runtime, compose, README, changelog, and release-note version markers to 0.4.4
• add the retained public_release_preflight.py release gate and wire its outputs into the GitHub workflow artifacts
• treat Celery RECEIVED jobs as running, enable task_track_started, and extend the async reference timeout used by release readiness
• mount docs/ and schemas/ into the source overlay so /mcp/resources/contract-manifest reflects the regenerated local bundle during live validation

Validation

• ./.venv/bin/python scripts/check_release_metadata.py
• ./.venv/bin/python scripts/check_distribution_artifacts.py
• ./.venv/bin/python scripts/generate_contract_artifacts.py --check
• ./.venv/bin/python -m unittest -v tests/test_celery_runtime_contract.py tests/test_release_readiness_script.py tests/test_release_metadata.py
• ./.venv/bin/python -m unittest -v tests/test_deployment_profiles.py tests/test_release_metadata.py
• ./.venv/bin/python scripts/public_release_preflight.py --auth-dev-secret pbpk-local-dev-secret

Notes

• local preflight passed before publishing this branch
• this PR is draft on purpose so the final release review stays explicit

[senseibelbi]

Pushed a follow-up fix for the failing CI / Runtime Contract check.

Root cause: the generated contract artifacts committed in the PR did not match what scripts/generate_contract_artifacts.py --check produces against the full GitHub repo surface. The test suite itself was passing; the failure was in the generated outputs.

What changed:

• regenerated docs/architecture/contract_manifest.json
• regenerated docs/architecture/release_bundle_manifest.json
• regenerated src/mcp_bridge/contract/artifacts.py

New head commit: 515c583

That should allow the required runtime-contract check to pass on the rerun.

[senseibelbi]

Pushed a broader follow-up fix at 92131e1.

Root cause of the repeated Runtime Contract failures: the PR branch was still only a partial subset of the validated local workspace, so GitHub Actions was running the current Makefile and deployment/import-footprint tests against stale repo files. That caused a sequence of missing-file and stale-import-surface failures even after the first contract-artifact regeneration.

What this commit does:

• aligns the branch with the validated runtime-contract surface from the local workspace
• adds the missing deployment, governance, S3 smoke, contributor-surface, import-footprint, and reviewer/scientific files that the current runtime-contract target expects
• regenerates the contract artifacts against that full surface

Local checks used before push:

• python scripts/generate_contract_artifacts.py --check
• python -m unittest -v tests.test_github_contributor_surface tests.test_import_footprint tests.test_deployment_profiles tests.test_s3_audit_smoke_script
• full misuse-prevention pytest slice passed locally before the final regeneration

[senseibelbi]

Pushed another follow-up at 18e8b43.

This addresses the latest CI failures on the merge ref:

• Lint: fixed the two Ruff UP031 violations in tests/test_runtime_security_live_stack.py
• Runtime Contract: regenerated the contract artifacts against the actual GitHub merge-ref content, which differs slightly from the branch-only tree because the staged source-tree bundle excludes OECD_PBPK_guidelines.pdf

The branch now contains the merge-ref-aligned versions of:

• docs/architecture/contract_manifest.json
• docs/architecture/release_bundle_manifest.json
• src/mcp_bridge/contract/artifacts.py
• tests/test_runtime_security_live_stack.py

Local verification before push:

• python -m ruff check tests/test_runtime_security_live_stack.py
• python scripts/generate_contract_artifacts.py --check