release: 26.3

[dyve]

Stamps the Unreleased section as 26.3 and bumps the version from 26.2. This is the deliberate re-cut that #901 asked for after #899 carried a dated heading and a version bump to main by accident; the branch was reset onto main, so nothing of the aborted cut survives here.

The notes are ordered by the convention in MAINTAINING.md: the dropped Python cycle first, then the bug fixes with the breaking one at their head, the system check, the dependency change, tooling, and documentation. The four coverage entries had accumulated at the top of Unreleased since #901 put the section in order, because each later PR prepended its own; they are tooling and now sort there.

Five entries are new, for changes that shipped without one. The old just release-check listed only commits touching src/, so it never flagged them; I read the full log instead. They are the coverage report step in CI (#904), the zizmor workflow hardening and the restored timeout-minutes (#900), the invisible-character lint (#888), the AI assistance and dependency update policies (#887, #900), and the CLAUDE.md shim (#885). That gap is what #910 has since fixed.

Rebased onto #910

Rebasing filed #910's two entries at the foot of the dated 26.3 section, with no conflict, because the two sides touch different lines. That is exactly the silent failure #910 and django-marina describe, reproduced here. They do belong in 26.3, since the justfile change ships in it, so they have been moved up into the tooling group rather than left where git put them. The blank line that split the list and the missing one before the ## 26.2 heading are repaired; both came in with #910's edit.

#910's release-check entry is merged into the entry that introduced the recipe. just release-check is new in this release, so "added it" followed by "changed it" is internal history rather than what shipped; the single entry describes the behaviour a reader will actually get. Say the word if you would rather have the two verbatim.

Verified

just lint passes. just test-cov is green at 100%, 173 tests over 808 statements and 286 branches. just build produces django_bootstrap4-26.3 with twine, check-manifest, pyroma (10/10), check-wheel-contents and both smoke tests passing.

#910's new lockfile guard was checked by making it fail, not only by watching it pass: setting uv.lock back to 26.2 stops build with Error - pyproject.toml says 26.3, uv.lock says 26.2. Run 'just relock'. With the lock regenerated, release-check reports Version: pyproject.toml 26.3, uv.lock 26.3.

One quirk to expect after this merges: release-check will print Entries in the Unreleased section of CHANGELOG.md: (none) next to two dozen listed commits, because stamping the section removes the ## Unreleased heading. It reads alarming and means nothing is pending.

AI assistance

Yes. Written with Claude Code, as the trailer on the commit records.

🤖 Generated with Claude Code

[coveralls]

coverage: 100.0%. remained the same — release-26.3 into main