release: RememberStack 0.16.0

[fazpu]

Problem

The engine changes already merged after v0.15.0 need one coherent public release. The published package, Compose image, generated API contract, and user-facing version documentation must share the same coordinate.

What this does

• bumps the Python package, lockfile, and Compose application image to 0.16.0
• regenerates the version-stamped OpenAPI document for the release asset
• records the release contents: the OpenAPI asset (feat(api): publish the deployment's OpenAPI schema #358), the narrow ingest scope (feat(auth): add a narrow ingest perimeter scope #363 and its attribution hardening fix(auth): reserve ingest attribution for write scope #370), and managed login hostname adoption (feat(login): derive the managed API URL #371)
• leaves the reviewed PostgreSQL foundation pins unchanged
• excludes the unmerged E0 MIME work in feat(e0): refuse an unroutable MIME at the E0 gate instead of dead-lettering it (D104) #342

How verified

• uv sync --locked
• uv run python scripts/check_release_contract.py --tag v0.16.0
• uv run lint-imports
• uv run ruff check src/ benchmarks/
• uv run ruff format --check src/ benchmarks/
• uv run pyright src/ benchmarks/
• uv run python scripts/export_openapi.py -o openapi.json
• full clean-PostgreSQL suite: 2,265 passed, 2 skipped, 1 failed in 49m41s; the only failure is the known macOS MIME-table assertion for .md in test_sdk_pushes_lineage_metadata_to_e0, owned by open feat(e0): refuse an unroutable MIME at the E0 gate instead of dead-lettering it (D104) #342 and not changed here. Linux CI is authoritative.

Docs

The project-status page has a v0.16.0 section for the three release items, and the CLI reference reports the new version.

Contributor agreement

• I have read and agree to the RememberStack Contributor License Agreement v1.0.