chore(release): 0.24.0

[imran-siddique]

Steps 1 to 3 of python/RELEASING.md. The tag and GitHub Release are yours — that is what fires the trusted-publisher upload, and I do not do it.

Four merged PRs are sitting unreleased, so pip install weight-custody-manifest still gets 0.23.0 with none of the schema or conformance work.

What ships

• Frozen v1 manifest JSON Schema (feat(spec): normative manifest JSON Schema, frozen at v1 #59), readable from the installed wheel
• Conformance suite (feat(conformance): conformance suite with levels, codes, and a runner #60, feat(conformance): vector L2 and L3 as time-ordered scenarios #63, feat(conformance): vector cryptographic quote verification #64): 91 vectors across all four levels, 41 codes, a scoring contract for other implementations
• retire_after parsing fix (feat(conformance): vector L2 and L3 as time-ordered scenarios #63): a value without a timezone offset raised TypeError out of verify_and_release and aborted the release path
• Bit-for-bit reproducible KBS image (build(docker): make the KBS image bit-for-bit reproducible #61)

No breaking API changes. Two new modules (wcm.schema, wcm.conformance), one new CLI verb (wcm conformance), one new dev-only dependency (jsonschema). So 0.23.0 → 0.24.0.

Verified against the built artifact

From a clean venv on the wheel, not the checkout:

version       0.24.0
schema $id    https://wcm.agentrust-io.com/schema/manifest/v1.json
vectors       91
codes         41
$ wcm conformance
L1 PASS 32/32   L2 PASS 37/37   L3 PASS 12/12   L4 PASS 10/10   exit 0

twine check passes on both the wheel and the sdist.

One thing for you to decide

The ## Unreleased section at the top of CHANGELOG.md is drifting and I did not touch it. It still holds narrative entries for things that already shipped in 0.23.0, notably the demos relocation (#48, 2026-07-27) and the demo notes, alongside the four new entries.

I added a ### 0.24.0 bullet entry under ## SDK, matching the established style there, and left ## Unreleased alone. Renaming it to ## 0.24.0 would be the Keep-a-Changelog move the file says it loosely follows, but it would mislabel the 0.23.0-era entries as 0.24.0, so I would rather you say which way you want it than have me quietly rewrite release history. Two options when you have a moment:

1. Split it: move the pre-0.23.0 narrative under a ## 0.23.0 heading, rename the rest to ## 0.24.0, and leave ## Unreleased empty for next time.
2. Drop the narrative section entirely and keep the per-version bullets under ## SDK as the single record.

Either is a small follow-up PR. It does not block this release.

After merge

git tag v0.24.0 && git push origin v0.24.0
gh release create v0.24.0 --target main --title v0.24.0 --notes-from-tag