Release v0.5.0b1

[github-actions]

Release v0.5.0b1

Auto-generated by the Prepare Release workflow.

What changed

• de_shell/__init__.py bumped to 0.5.0b1 — the one place the version is
  written, and the value publish.yml refuses to let a tag disagree with
• Pre-flight checks passed: git dependencies pinned to SHAs or tags
• CHANGELOG.rst assembled from the fragments in upcoming_changes/

Release notes (as they will appear in `CHANGELOG.rst`)

0.5.0b1 (2026-10-13)
====================

Bug Fixes
---------

- The packaged sidecar runs from its Python environment rather than the install
  directory, so a Windows update can remove the old version. Its working
  directory used to hold the install directory open, and the update stalled at
  "cannot be closed. Please close it manually and click Retry". (`#4 <https://github.com/directelectron/de-shell/pull/4>`_)

Review checklist

• CHANGELOG.rst reads well — edit the assembled text directly if needed
• Version is correct in de_shell/__init__.py
• CI passes — but note it does NOT start on its own here: GitHub suppresses
  workflow runs for events raised with GITHUB_TOKEN, so a PR opened by this
  workflow gets no pull_request run. Close and reopen the PR, or push an
  empty commit to it, to get one. The wheel-contents leg is the one that
  matters most: it fails if de_shell/js is missing, which is the whole
  point of the package.

Manual check CI cannot cover

CI never runs Electron — it typechecks the TypeScript and runs the node unit
tests, nothing more. Before tagging a release that touched the sidecar
protocol or de_shell/js:

• Link this tree into one app (python -m de_shell.js prints the path)
  and run that app's e2e suite against it.

After merging

Tag the merge commit on main — the tag MUST be exactly v0.5.0b1:

git fetch origin
git tag v0.5.0b1 origin/main
git push origin v0.5.0b1

The tag push triggers publish.yml: it refuses a tag that does not match
de_shell.__version__, builds the distributions, checks the wheel carries
de_shell/js, and uploads to PyPI through trusted publishing.

• Confirm it actually published before telling the apps to pin it:
  uv pip index versions de-shell should list 0.5.0b1.