[v1.0] Release 0.4.3 with post-0.4.2 hardening

[codeforester]

Goal

Publish a clean 0.4.3 patch release containing the hardening that landed after 0.4.2.

Scope

• Include the merged post-0.4.2 fixes for redaction, JSON pre-parse behavior, cwd coordination, terminal/bidi sanitization, schema immutability, protocol-header validation, and published-doc hygiene.
• Remove duplicate or stale entries from CHANGELOG.md.
• Build and validate one sdist/wheel set, run the release gates, publish to TestPyPI, then publish to PyPI and create the GitHub release.
• Record the release notes and artifact verification evidence.

Acceptance criteria

• VERSION, package metadata, tag, GitHub release, and PyPI all report 0.4.3.
• The release contains no internal planning documents or stale changelog entries.
• TestPyPI rehearsal, wheel smoke tests, checksums, SBOM, attestations, and publication checks pass.
• The release notes identify user-visible fixes and any compatibility implications.

Project fields

• Status: Backlog
• Priority: P0
• Area: Packaging
• Initiative: v1.0 Readiness
• Size: M

[codeforester]

Released base-cli 0.4.3.

• PR release: prepare base-cli 0.4.3 #262 merged at 8a93d22
• TestPyPI rehearsal passed: https://github.com/basefoundry/base-cli/actions/runs/33233337230
• Production package workflow passed: https://github.com/basefoundry/base-cli/actions/runs/33233425837
• PyPI: https://pypi.org/project/base-cli/0.4.3/
• GitHub Release: https://github.com/basefoundry/base-cli/releases/tag/v0.4.3
• Isolated installs from TestPyPI and PyPI reported base-cli 0.4.3 with no broken requirements.

Base and base-demo dependency updates remain a separate follow-up; no releases were made in those repositories.