ci: trigger Argus test-sdk after merge

…ethod

chore: pipeline validation test

* security: add PEP 740 attestations to PyPI publish workflow

- Pin pypa/gh-action-pypi-publish to SHA (v1.14.0)
- Enable attestations: true for PEP 740 provenance
- Add test job before publish (tests must pass before release)
- Add explicit permissions: { contents: read } at workflow level
- Bump version to 0.1.1
- Document attestation in README

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: remove test job from publish workflow

SDK tests are integration tests requiring staging API + service
containers. They run on PRs via feature-to-main.yml. The publish
workflow trusts that tests passed during the PR process.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Gk <gk@Gks-MacBook-Pro.local>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

The cueapi-sdk package on PyPI was missing the Bug Tracker project URL,
meaning users had no link to report issues. Adds the correct URL pointing
to https://github.com/cueapi/cueapi-python/issues.

Also bumps version to 0.1.2 (metadata-only patch) and syncs __version__
in __init__.py.

Co-authored-by: Gk <gk@Gks-MacBook-Pro.local>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

… bump to 0.1.3

Reconciles pyproject.toml license with LICENSE file content and repo
description (Apache-2.0, not MIT). Adds Trove classifiers, expanded
keyword list, maintainers block, and Changelog/Source Code/Status Page URLs.
No code changes.

The server's /v1/executions/{id}/outcome endpoint already accepts a
`result_ref` evidence field (see OutcomeRequest in cueapi/cueapi
app/schemas/outcome.py). The SDK's report_outcome was missing it,
forcing callers who want to attach a reference ID to fall back to
either raw HTTP or using an unrelated field like external_id.

Single-line addition in executions.py: new kwarg, forwarded to the
POST body when provided, same shape as every other evidence field.

Companion change in cueapi-worker 0.3.0 (monorepo PR in cueapi/cueapi)
exposes the same field on its WorkerAPIClient so worker-transport
handlers can surface result_ref via the new CUEAPI_OUTCOME_FILE
pattern.

No behavioral change for existing callers — kwarg is optional and
defaults to None.

Co-authored-by: Gk <gk@Gks-MacBook-Pro.local>