fix(ci): pass GITHUB_TOKEN to auto-tag gh dispatch (B15tg)

.github/workflows/auto-tag.yml

@@ -33,6 +33,7 @@ jobs:
       - name: Validate merged version and create tag
         env:
           GH_REF_NAME: ${{ github.ref_name }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           git fetch --tags --force

.github/workflows/publish.yml

@@ -74,11 +74,11 @@ jobs:
       - name: Install test deps
         run: |
           python -m pip install --upgrade pip
-          python -m pip install pytest numpy pandas pydantic scikit-learn scipy itis-dakota==1.5.9
+          python -m pip install pytest
 
       - name: Install wheel and run tests
         run: |
-          python -m pip install --force-reinstall --no-deps dist/*.whl
+          python -m pip install dist/*.whl
           python -m pytest
 
 

SPEC.md

@@ -186,3 +186,4 @@ B11xy|2026-08-19|`publish.yml`'s `testpypi` job ran pytest against the installed
 B12mn|2026-08-19|`pyproject.toml` `requires-python` had drifted to `>=3.10,<3.14` ("broaden python compatibility matrix") while the pinned engine `itis-dakota==1.5.9` ships wheels only for cp310-cp312 (verified via PyPI JSON) — installing on 3.13 would fail dependency resolution, promising support §C never backed|tightened to `>=3.10,<3.13` w/ a comment tying the bound to the pinned wheel; re-widen only alongside a T16mo engine bump
 B13qf|2026-08-19|3 latent Python-3.10 incompatibilities (`datetime.UTC`, `typing.Self`, bare `import tomllib` — all stdlib/typing 3.11+ additions) shipped undetected because the pre-`ci/matrix-and-coverage` CI ran a single Python version; surfaced only once the 3.10-3.13 test matrix actually ran each version for the first time|`datetime.timezone.utc` / `sys.version_info`-gated `typing_extensions.Self` fallback / try-`tomllib`-except-`tomli` fallback + conditional deps; preventive: V41hp — `ty check` resolves these against `requires-python`'s floor in one static run, cheaper than a runtime matrix for this bug class
 B14zt|2026-08-27|`itis-dakota==1.5.9` was deleted from PyPI upstream (release list jumps `1.5.1`→`1.5.11`→`6.23.0`+, no `1.5.9`; that version's PyPI JSON endpoint 404s) — invisible because `uv.lock` still installs from its cached wheel URLs/hashes, but T43bv's alpha-bump commit changes `pyproject.toml`'s `[project]` table on every qualifying PR, which invalidates the lock and forces a live re-resolve; that re-resolve then fails outright since the pinned version no longer exists in the index (reproduced locally: identical repo, only `version` differs, `uv@latest sync` succeeds unchanged / fails re-resolved)|bumped engine pin to `itis-dakota==1.5.11` (T16mo rung 1, already earmarked in a pyproject.toml comment — packaging-only, same Dakota 6.20 engine, adds cp313 wheels); widened `requires-python` to `<3.14`; regenerated `uv.lock`; 318-test local suite + `ty`/`ruff` green, cp313 install confirmed; V43zt
+B15tg|2026-08-27|the `v0.1.0a2` tag (created by auto-tag.yml on the develop merge) exists, but no TestPyPI publish followed — auto-tag's trailing `gh workflow run publish.yml` did not fire. Root cause: the `tag-merged-version` step invoked `gh` from an inline Python script that read `GITHUB_TOKEN` out of the step environment, but the step's `env:` block only exported `GH_REF_NAME`, so `gh` got no usable token and the dispatch silently did nothing|add `GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}` to the `tag-merged-version` step's `env:` block so the inline `gh` call inherits a valid token; one-off `gh workflow run publish.yml --ref develop --field tag=v0.1.0a2 --field registry=testpypi` published a2 manually to recover the missed alpha; V29yn

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "itis-sumo"
-version = "0.1.0a2"
+version = "0.1.0a3"
 description = "Surrogate Modeling functionality for IT'IS Foundation / ZMT Modeling Intelligence suite: build, evaluate, cross-validate surrogates + UQ + sampling, headless or embedded"
 readme = "README.md"
 # T16mo rung 1 (1.5.9->1.5.11): 1.5.11 ships cp313 wheels, so the <3.13