Prepare the 0.7.1 source release candidate

[JovaniPink]

Summary

Prepare the focused 0.7.1 source and wheel metadata for the SCXML fixture-custody and parallel-conformance work already merged in #36 and #37.

This PR advances version surfaces from 0.7.0 to 0.7.1, documents the bounded runtime changes already on master, and makes package-index publication fail closed until name ownership and authorization are explicitly verified. It adds no runtime behavior.

Why

master owns the configured SCXML fixture subset and passes the expanded parallel cases, but package metadata and the manual preflight still identified 0.7.0. The first draft also treated pip install xstate and PyPI publication as ready even though the public xstate project is a separate 0.0.1 distribution and JovaniPink ownership is not established.

The repaired release boundary keeps the technically complete 0.7.1 artifacts while refusing to turn unverified package-index ownership into a marketing or operational claim.

Scope

• Bump [project].version to 0.7.1.
• Add the 0.7.1 changelog entry for repository-owned SCXML fixtures, the safe fixture-proven integer subset, 15 enabled more-parallel cases, and corrected atomic self-transition behavior.
• Advance the manual Release Preflight default and its contract test to v0.7.1.
• Synchronize README, agent context, product notes, and comparison documentation.
• Replace the misleading pip install xstate instruction with exact-commit source installation.
• State that the declared distribution name is provisional because PyPI ownership is unresolved.
• Gate the release publish job on vars.PYPI_PUBLISH_ENABLED == 'true' in addition to the existing token, tag, master-ref, draft, and prerelease checks.
• Preserve historical 0.7.0 references and runtime/API behavior.

Evidence and dependency order

• Base: master at 502da528777a72c3e26057fd54142c229a566bd2.
• Vendor the exercised SCXML fixture subset #36 and Expand SCXML parallel conformance #37 are already merged prerequisites.
• Exact current head: 0462a3b5394ec4fd2a9feed816c56b2251f78570.
• PyPI currently lists xstate 0.0.1 under a different maintainer; no JovaniPink release or ownership was verified.
• The repository currently has no GitHub releases and no PYPI_PUBLISH_ENABLED variable, so the publish job is fail-closed.

Intended order: merged #36 and #37 -> this source metadata PR -> post-merge preflight on exact master -> separate owner decision about package name, index ownership, GitHub Release, and publication.

Validation

• Primary suite: 428 passed.
• SCXML suite: 57 passed (56 configured cases plus fixture inventory guard).
• Ruff format and lint: passed.
• MyPy: no issues in 22 source files.
• poetry check --lock: passed.
• 0.7.1 sdist and wheel: built successfully.
• Isolated wheel install and actor smoke test: passed.
• Workflow contract test enforces the explicit PYPI_PUBLISH_ENABLED gate.
• Negative release-target test: the preflight correctly rejected the unmerged branch because HEAD did not equal origin/master.
• git diff --check: passed.

The complete preflight must be rerun after merge against the exact merge commit, when HEAD and origin/master are equal.

Public claim boundary

• 0.7.1 is an alpha source/wheel candidate, not a verified PyPI release.
• pip install xstate currently refers to a separate public distribution.
• Passing tests and building artifacts do not prove package-index ownership or authorize publication.
• The configured 56-case subset does not imply full W3C SCXML or general JavaScript-datamodel conformance.

Non-goals

• No changes to runtime modules, fixtures, public APIs, dependencies, or supported Python versions.
• No tag, GitHub Release, PyPI ownership claim, provider-variable change, secret change, or publication.
• No package rename; the final distribution name remains an owner decision.

Risk and rollback

• Version drift is covered by workflow tests and the shared preflight.
• Publication remains safely disabled unless an owner deliberately enables the repository variable after verifying the package destination and credentials.
• Before publication, rollback is a normal revert of the squash commit. A published package would require a follow-up version because index artifacts are immutable evidence.

Review focus

1. Changelog accuracy without overstating SCXML conformance.
2. Consistency of the 0.7.1 source-candidate label across public and agent-facing docs.
3. Fail-closed publishing when package-index ownership is unresolved.
4. Separation of merge, preflight, tag, GitHub Release, package-index authorization, and publication.

Unresolved owner decision

Choose and verify the final Python distribution destination: obtain authorized ownership of xstate or select a different package name. Only then should PYPI_PUBLISH_ENABLED be created and a release publication considered.