feat(hawk-sdk-python): production hardening

[Patel230]

Summary

Production-hardening pass for hawk-sdk-python that brings the repo to
top-50 OSS standards. The branch contains two commits — a Python-toolchain
hardening pass and a __version__ fix + full-OSS-bootstrap pass — both
targeting main (this repo does not have a dev branch).

The mandate (per GOAL.md) is that this SDK be the reference Python
SDK for hawk daemon clients, comparable in quality to openai-python,
anthropic-sdk-python, langchain, llama-index, dspy, instructor,
marvin, pydantic-ai, mirascope, magentic.

This PR closes a real bug (the version surface was inconsistent —
pyproject.toml reported 0.2.0 but hawk.__version__ reported
0.1.0) and adds the CHANGELOG, CONTRIBUTING, SECURITY,
CODE_OF_CONDUCT, .gitattributes, .editorconfig, and full .github/
that were missing.

Commits

1. feat(hawk-sdk-python): production hardening — ruff, mypy, version bump
2. feat(hawk-sdk-python): align __version__ with pyproject, add User-Agent, full OSS bootstrap

---

What's in commit 1 — Python-toolchain hardening

• Strict ruff lint config in pyproject.toml: rule sets E, F,
  W, I, N, UP, B, A, SIM, TCH, RUF (with E501
  ignored in favour of the project's 100-col limit).
• mypy --strict config in pyproject.toml with
  warn_return_any and warn_unused_configs.
• Makefile with standard targets (test, test-coverage, lint,
  format, typecheck, clean, help).
• pytest strict markers and short-traceback config.
• Bumped pyproject.toml to 0.2.0 (this PR completes the bump by also
  updating _version.py).

---

What's in commit 2 — version fix + User-Agent + OSS bootstrap

Version 0.2.0 — fix the inconsistency

File	Change
src/hawk/_version.py	__version__ = "0.2.0" (was "0.1.0")
pyproject.toml	already "0.2.0" (set by commit 1)

After this PR, hawk.__version__ and pyproject.toml agree on 0.2.0.

User-Agent

File	Change
src/hawk/client.py	HawkClient._build_headers and AsyncHawkClient._build_headers both set User-Agent: hawk-sdk-python/<__version__>. httpx merges client-default headers with per-request overrides, so this also covers chat_stream (the headers={"Accept": "text/event-stream"} override no longer drops the User-Agent).

New OSS bootstrap (every one of these was missing)

File	Purpose
CHANGELOG.md	Keep-a-Changelog format with [Unreleased] for this PR + backfilled [0.1.0] entry
CONTRIBUTING.md	venv + editable install, branch-from-main flow, conventional commits, code standards (mypy --strict, ruff, async-first, Pydantic v2, User-Agent rule), testing with respx, bump-both-version-files procedure
SECURITY.md	reporting via GitHub Security Advisories, in-scope examples (token leakage, TLS misuse, Pydantic deserialization, redirect host escape), out-of-scope pointers
CODE_OF_CONDUCT.md	Contributor Covenant 2.1
.gitattributes	LF normalization, binary detection, linguist hint to collapse lock files
.editorconfig	UTF-8, LF, 4-space Python (PEP 8), 2-space for YAML/JSON/TOML, no-trim for Markdown
.github/workflows/ci.yml	pytest matrix on Python 3.9 / 3.10 / 3.11 / 3.12 / 3.13, ruff lint + format check, mypy --strict, build sdist + wheel + twine check
.github/dependabot.yml	weekly pip + github-actions, pip grouped by pydantic and pytest to reduce PR noise
.github/PULL_REQUEST_TEMPLATE.md	Summary / Changes / API impact (with bump-both-files reminder) / Daemon compatibility / Async compatibility (sync + async kept in lock-step) / Testing / Checklist
.github/ISSUE_TEMPLATE/bug_report.yml	surface dropdown (HawkClient / AsyncHawkClient / streaming / retry / tools / agent / workflow / typed errors / build), required SDK + daemon + Python versions, package-versions textarea
.github/ISSUE_TEMPLATE/feature_request.yml	kind selector covering 9 areas + solo-dev fit checks (incl. 'sync and async kept in lock-step', 'does not break wire-compatibility')
.github/ISSUE_TEMPLATE/config.yml	routes security to advisories, questions to discussions, blocks blank issues
.gitignore	expanded from 6 lines to the full Python toolchain footprint (venv, .mypy_cache, .ruff_cache, .pytest_cache, .tox, .nox, htmlcov, coverage.xml, .env)

Verification

Check	Status
pytest	✅ 65 passed, 1 pre-existing cosmetic warning
hawk.__version__	✅ returns "0.2.0"
HawkClient()._build_headers()	✅ returns {'Accept': 'application/json', 'User-Agent': 'hawk-sdk-python/0.2.0'}

The pre-existing warning (coroutine '_async_noop' was never awaited in
test_workflow.py::TestAsyncWorkflow::test_simple_pipeline) is from the
prior commit's mock setup, not introduced by this PR. It's cosmetic —
tests still pass — and tracked as a follow-up.

Test plan

• pytest (65/65 pass)
• python -c "from hawk import HawkClient, __version__; assert __version__ == '0.2.0'"
• User-Agent header verified to be set on default-config client
• CI on this PR will run pytest across 5 Python versions (3.9 →
  3.13), ruff check, ruff format --check, mypy --strict, and
  sdist + wheel build with twine validation