chore(release): prepare 0.97.0

[openadapt-lifecycle]

Prepares 0.97.0, up from 0.96.1, across 5 commits.

Written by scripts/plan_release.py from the conventional commits since the last tag. Merging this does not publish anything. After it lands, dispatch Release and publish with version 0.97.0 and the merge commit SHA.

Read the changelog section before merging. That is the whole point of this pull request.

[abrichr]

Please regenerate this proposal after two release blockers land.

The release workflow doesn't authorize the exact post-merge commit. It checks that the requested SHA is current main, but it never checks whether the test workflow passed for that SHA. Main protection uses a non-strict test check. The checks shown here apply to 3d433b0, not the later squash commit on main. A release dispatch can therefore tag a new or failed main commit. Require a successful named test run for the requested 40-character SHA before tag creation. Add regression cases for missing, pending, failed, and mismatched runs.

The built wheel redistributes modified copies of VAGEN's gym_base_env.py and gym_image_env.py. The wheel and sdist carry only OpenAdapt's copyright notice. VAGEN's MIT license requires its copyright and permission notice to travel with copied code. Record the source repository, commit fe4b11db336bb9474aa5b30651460caeb598f97f, source paths and hashes, and modification state. Ship the VAGEN notice in both archives, then make a built-archive test fail when that notice is absent.

I built exact head 3d433b0: the wheel is 1,056,488 bytes and the sdist is 62,164,539 bytes. check_source_boundary.py --require-dist passes, which confirms that the current crown-jewel scan does not check third-party notice inventory.

Closed by an agent session, not the founder.