[SizzleUnrlsd]

Summary

First deliverable of the product track: the analyzer installs as a self-contained package and can be published.

• Acceptance tests first (test: define packaging and bundled plugin behavior), implementation follows.
• The 26 plugins move from plugins/ into the package, under coretrace_python/bundled/. They are part of the wheel (manifests, models and detectors included; tests and test repositories excluded), and engine.BUNDLED_PLUGINS points at them.
• --check loads the bundled plugins by default; --plugins DIR adds directories on top, --no-bundled-plugins runs without them. A manifest found under several roots is loaded once.
• pyproject.toml: classifiers, project URLs, build and twine in the dev extras, bundled plugins excluded from mypy (they are loaded by path, not imported). The installed distribution version matches coretrace_python.__version__.
• CI gains a package job: build the sdist and wheel, twine check, install the wheel in a clean virtual environment and run a --check on a sample; the archives are uploaded as an artifact.
• New release.yml: on a v* tag, verify that the tag matches the version in pyproject.toml, build, check and publish to PyPI through trusted publishing (environment pypi, no stored token).
• README: install section and commands without --plugins plugins/; docs/architecture.md §25 points at the bundled directory.

To publish a release

One-time setup on pypi.org: add a trusted publisher for CoreTrace/coretrace-python-analyzer, workflow release.yml, environment pypi, and create the pypi environment in the repository settings. Then git tag v0.1.0 && git push origin v0.1.0.