chore(release): 0.1.29

[rldyourmnd]

Summary

• VERSION 0.1.29; changelog heading ## [0.1.29] - 2026-09-28.
• Publishable re-cut of 0.1.28: the pushed 0.1.28 tag is an unsigned
  lightweight ref with no promotion record, so the promotion gate correctly
  refused it and release-tag immutability forbids updating it in place.
• After merge, the tag will be created as git tag -s 0.1.29 -F promotion.json
  carrying the nddev-public-release-promotion/v2 record bound to this
  merge commit's push evidence (ci run, static validators job, security run).

Validation

• validate_all --tier release on the release branch: all checks pass
  except release-ledger-tags, which needs the tag ref created after merge.

Test plan

• Wait for push-triggered ci, static validators, and a security
  run on the merge commit.
• Render promotion record, sign-tag, push, watch release.yml reach
  publish and verify five checksummed assets.