The tracking server imports burr.examples.hello-world-counter.server
(added in #675) but the release config still had it in the exclude
list. Move it from exclude to include so the wheel ships with the
module the server needs, preventing ModuleNotFoundError when running
burr from a fresh install.

Also bumps REQUIRED_EXAMPLES in scripts/apache_release.py and updates
tests/test_release_config.py accordingly.

Preparation for the release-validation CI workflow.

apache_release.py:
- Add --skip-signing to archive/sdist/wheel/all subcommands
- Split _sign_artifact into checksum (always) and GPG sign (skippable)
- Drop gpg from required tools when --skip-signing is set

ci_smoke_server.py:
- Installs a built wheel into a fresh venv outside the source tree
- Imports burr.tracking.server.run (catches missing-example bugs like #675)
- Starts the burr server on a free port with a dedicated data dir
- Runs a tracked app, verifies the server observes the project

Build the full release pipeline on every PR, plus RAT license check
and an end-to-end smoke install of the wheel outside the source tree.
This catches the failure modes that have broken recent RCs:

- build-artifacts: runs apache_release.py all --skip-signing --no-upload,
  verifies the 3 artifacts exist, runs Apache RAT without --report-only
  so license violations fail the job.
- install-and-smoke: on 3.10/3.11/3.12, installs the wheel into a fresh
  venv and runs scripts/ci_smoke_server.py. That helper imports the
  server module, boots the server, runs a tracked app, and asserts the
  server sees the project — so a missing example (like PR #675's
  hello-world-counter) would fail here.

Only "build-artifacts" and "install-and-smoke (3.12)" are required
checks in .asf.yaml; 3.10 and 3.11 are informational.

The tracking server imports burr.examples.hello-world-counter.server
(added in #675) but the release config still had it in the exclude
list. Move it from exclude to include so the wheel ships with the
module the server needs, preventing ModuleNotFoundError when running
burr from a fresh install.

Also bumps REQUIRED_EXAMPLES in scripts/apache_release.py and updates
tests/test_release_config.py accordingly.

Preparation for the release-validation CI workflow.

apache_release.py:
- Add --skip-signing to archive/sdist/wheel/all subcommands
- Split _sign_artifact into checksum (always) and GPG sign (skippable)
- Drop gpg from required tools when --skip-signing is set

ci_smoke_server.py:
- Installs a built wheel into a fresh venv outside the source tree
- Imports burr.tracking.server.run (catches missing-example bugs like #675)
- Starts the burr server on a free port with a dedicated data dir
- Runs a tracked app, verifies the server observes the project

Build the full release pipeline on every PR, plus RAT license check
and an end-to-end smoke install of the wheel outside the source tree.
This catches the failure modes that have broken recent RCs:

- build-artifacts: runs apache_release.py all --skip-signing --no-upload,
  verifies the 3 artifacts exist, runs Apache RAT without --report-only
  so license violations fail the job.
- install-and-smoke: on 3.10/3.11/3.12, installs the wheel into a fresh
  venv and runs scripts/ci_smoke_server.py. That helper imports the
  server module, boots the server, runs a tracked app, and asserts the
  server sees the project — so a missing example (like PR #675's
  hello-world-counter) would fail here.

Only "build-artifacts" and "install-and-smoke (3.12)" are required
checks in .asf.yaml; 3.10 and 3.11 are informational.

* fix: add __init__.py to tests/ so pytest discovery works

* fix: add ASF license header to tutorial.md

* fix: update .rat-excludes for RC2 feedback

- Fix patterns for burr/examples/ symlink duplicates (use .* prefix)
- Add .github/ templates (YAML/MD with frontmatter)
- Add image file extensions (.png, .gif, .ico, .jpg)

* fix: include hello-world-counter in release artifacts

The tracking server imports burr.examples.hello-world-counter.server
(added in #675) but the release config still had it in the exclude
list. Move it from exclude to include so the wheel ships with the
module the server needs, preventing ModuleNotFoundError when running
burr from a fresh install.

Also bumps REQUIRED_EXAMPLES in scripts/apache_release.py and updates
tests/test_release_config.py accordingly.

* fix: use sys.executable for uvicorn subprocess to fix venv isolation

The CLI spawned uvicorn as a bare command, which resolves via PATH.
For users with pyenv installed, ~/.pyenv/shims/ is in PATH ahead of
any venv's bin/, so bare `uvicorn` always hits a pyenv shim that
routes to a pyenv environment — never the venv the user is running
burr from. This means a fresh `pip install` into a non-pyenv venv
fails to start the server.

Using sys.executable -m uvicorn ensures uvicorn runs under the same
Python interpreter that is running burr, regardless of PATH.

* chore: add --skip-signing flag and CI smoke-test helper

Preparation for the release-validation CI workflow.

apache_release.py:
- Add --skip-signing to archive/sdist/wheel/all subcommands
- Split _sign_artifact into checksum (always) and GPG sign (skippable)
- Drop gpg from required tools when --skip-signing is set

ci_smoke_server.py:
- Installs a built wheel into a fresh venv outside the source tree
- Imports burr.tracking.server.run (catches missing-example bugs like #675)
- Starts the burr server on a free port with a dedicated data dir
- Runs a tracked app, verifies the server observes the project

* ci: drop svn requirement from 'all' command when --no-upload is set

CI runners don't have svn installed. The 'all' subcommand listed svn as
a required tool unconditionally, but svn is only used during the upload
step. Skip the requirement when --no-upload is passed.

* ci: add release validation workflow

Build the full release pipeline on every PR, plus RAT license check
and an end-to-end smoke install of the wheel outside the source tree.
This catches the failure modes that have broken recent RCs:

- build-artifacts: runs apache_release.py all --skip-signing --no-upload,
  verifies the 3 artifacts exist, runs Apache RAT without --report-only
  so license violations fail the job.
- install-and-smoke: on 3.10/3.11/3.12, installs the wheel into a fresh
  venv and runs scripts/ci_smoke_server.py. That helper imports the
  server module, boots the server, runs a tracked app, and asserts the
  server sees the project — so a missing example (like PR #675's
  hello-world-counter) would fail here.

Only "build-artifacts" and "install-and-smoke (3.12)" are required
checks in .asf.yaml; 3.10 and 3.11 are informational.

* fix: rewrite .rat-excludes with basename patterns that actually work

RAT's -E regex doesn't reliably match through path separators or
symlinked directories. The previous patterns like
'examples/deep-researcher/prompts.py' never excluded anything because
RAT effectively matches against basenames. We never noticed because
all prior RAT runs used --report-only mode.

Switch to basename patterns. The .tsx files are uniquely named, so
basename matching is precise. prompts.py only exists once. utils.py
matches 5 different files (all our own ASF code with headers); the
practical risk of skipping their checks is low.

Update the leading comment in .rat-excludes to document the constraint
so future authors don't repeat the mistake.

* chore: add .claude/ to .gitignore

* fix: address review feedback (paths-ignore, basename collisions, count)

- Workflow: drop '**/*.md' from paths-ignore. It would suppress runs
  whenever a bundled .md file (like the deployment tutorial.md) changes
  — exactly the case that triggered RC2 feedback.
- .rat-excludes: document the basename collisions for utils.py and
  button.tsx so the next maintainer doesn't think they're unique.
- test_release_config.py: fix '4 examples' string that should have been
  bumped to 5 when hello-world-counter was added.

* fix: use os.path.lexists in _prepare_wheel_contents to handle broken symlinks

On CI runners, burr/examples is a relative symlink ('../examples') that
may not resolve from the process's working directory — os.path.exists
returns False for a broken link while the link itself is still present
on disk. That made _prepare_wheel_contents skip the removal branch and
then fail on os.makedirs with 'File exists: burr/examples'.

Switch to os.path.lexists, which returns True for any directory entry
including broken symlinks, so the cleanup branch always runs when the
link is present.