release(v2.3.0): reconcile Cargo.toml + CHANGELOG (closes #173) (#184)

## Why

Closes #173 — Cargo.toml version (2.1.0), CHANGELOG release headers
(latest 2.2.0 + `[Unreleased] - 2026-04-20`), and git tags (latest
`v1.5.0`) disagreed across three doc surfaces. Owner selected **Option
B** from #173: bump Cargo.toml to 2.3.0, promote `[Unreleased] -
2026-04-20` to `[2.3.0] - 2026-06-01`, cut tag at merge SHA.

Rationale (verbatim from owner direction):

- CHANGELOG's `[Unreleased] - 2026-04-20` block already documents
post-2.2.0 work → 2.3.0 is the consistent next number.
- `CLAUDE.md` (pre-#170) already carried `Version: 2.3.0` → 2.3 was the
working assumption.
- Skips Option A (retroactive `v1.6.0` / `v1.6.1` / `v2.2.0` tags);
those entries remain history-with-no-tag.
- Skips Option C (demoting CHANGELOG entries).

## Changes

- `Cargo.toml`: `version = "2.1.0"` → `version = "2.3.0"`
- `CHANGELOG.md`: rename `## [Unreleased] - 2026-04-20` → `## [2.3.0] -
2026-06-01`; insert fresh empty `## [Unreleased]` block above it.
Existing 2.2.0 / 1.6.1 / 1.6.0 / 1.5.0 entries left untouched (per
owner's "stay as history" direction).
- `Cargo.lock`: `cargo generate-lockfile` resync to pick up the
workspace version bump. No package set changes (469 → 469 packages; no
`Adding` lines for echidna's own deps — just reports available upgrades,
none applied).

## Post-merge manual steps (DO AFTER SQUASH-MERGE LANDS)

The squash-merge produces the SHA the tag must point at, so these can't
run pre-merge:

```sh
MERGE_SHA=$(gh api repos/hyperpolymath/echidna/pulls/<this-PR-number> --jq .merge_commit_sha)
git tag -a -s v2.3.0 \
  -m "v2.3.0 — Cargo.toml/CHANGELOG reconciliation per #173" \
  "$MERGE_SHA"
git push origin v2.3.0
gh release create v2.3.0 \
  --title "v2.3.0" \
  --notes "$(awk '/^## \[2.3.0\]/,/^## \[/' CHANGELOG.md | head -n -1)" \
  --repo hyperpolymath/echidna
```

## Auto-release wiring already in place

Audit of `.github/workflows/` shows two workflows that will fire
automatically once the GitHub Release is created:

- `ghcr-publish.yml` — `on: release: [published]` → container image
publish to GHCR.
- `generator-generic-ossf-slsa3-publish.yml` — `on: release: [created]`
→ SLSA L3 provenance generator.

So the **only** manual steps post-merge are the three lines above (`git
tag` + `git push` + `gh release create`). Image + provenance publication
then auto-fire.

## Not in scope

- Retroactive v1.6.0 / v1.6.1 / v2.2.0 tag recovery (Option A,
explicitly declined).
- Rewriting existing CHANGELOG entries for 2.2.0 / 1.6.1 / 1.6.0 (Option
C, explicitly declined).

Refs #173, #170, #169, hyperpolymath/standards#329 (R5b governance rule
exempting `CHANGELOG.md` + `Cargo.toml` from doc-drift scan — explains
why this drift didn't trip CI).

Author: hyperpolymath

CHANGELOG.md

@@ -5,7 +5,9 @@ All notable changes to ECHIDNA will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased] - 2026-04-20
+## [Unreleased]
+
+## [2.3.0] - 2026-06-01
 
 ### Added
 - **105 ProverKind variants** (exhaustive HP type-checker ecosystem).

Cargo.lock

@@ -2,7 +2,7 @@
 
 [package]
 name = "echidna"
-version = "2.1.0"
+version = "2.3.0"
 edition = "2021"
 authors = ["Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"]
 license = "AGPL-3.0-or-later"