chore(release): v0.5.0 — U3, the declared embed seam

Minor rather than patch, and the tie-break rule says default to patch, so the
reason is worth stating: a capability arrived AND one left. Report authors gain
a declared public API -- one line, `<script src="/_booth/embed.js" defer>`, plus
the `data-booth-mark` anchor syntax -- and the verbatim path loses
no-JavaScript operation, which it had since it existed.

That asymmetry is what makes it not a tie. Either half alone would have been
defensible as a patch.

Operator approved 2026-09-22.

ROADMAP.md

@@ -1,8 +1,7 @@
 # The Booth — roadmap
 
 Design: [`docs/design/information-architecture.md`](docs/design/information-architecture.md).
-Current version: `0.4.0` (U1, U2, U3, U4 and U5 landed; extracted from eshpfi 2026-09-21).
-U3's release tier is with the operator — it reads minor, and minor needs his approval.
+Current version: `0.5.0` (U1, U2, U3, U4 and U5 landed; extracted from eshpfi 2026-09-21).
 
 ## v1 target
 
@@ -13,7 +12,7 @@ defect — not a wish. The measurements are in the IA doc.
 |---|---|---|---|
 | 1 | ~~**One item record**~~ — **landed `ce598b3`** | captions never reach the zoom view (never sent, not lost) | U1 |
 | 2 | ~~**Marks**~~ — **landed `c7f9437`, released `v0.2.0`** | 5 mechanisms for 1 job; operator→session loop runs through chat | U2 |
-| 3 | ~~**Declared embed seam**~~ — **landed 2026-09-22** | 6 regexes injected into arbitrary author HTML, load-bearing for asks | U3 |
+| 3 | ~~**Declared embed seam**~~ — **landed `87e2c53`, released `v0.5.0`** | 6 regexes injected into arbitrary author HTML, load-bearing for asks | U3 |
 | 4 | ~~**Derived lifetime**~~ — **landed `c3a97c1`, released `v0.4.0`** | 70% of booths on the `.forever` escape hatch (54% when first counted) | U4 |
 | 5 | ~~**Self-announcing booths**~~ — **landed `c015a91`, released `v0.3.0`** | job 5 had no home, so it lived on the link board as 145 dead rows | U5 |
 | 6 | **Benches** — registry, identity, enforced rule, migration | 69% link-board rot; the same bench posted 5× | U6 |

persistent-memory.md

@@ -24,10 +24,14 @@ _As of 2026-09-22:_
 - **U1, U2, U3, U4 and U5 are landed — the whole middle tier is closed.** U1
   `ce598b3`; U2 `c7f9437` → `v0.2.0`, `5e41108` → `v0.2.1`, `026a1fc` →
   `v0.2.2`; U5 `c015a91` + `95beede` → `v0.3.0`; U4 `c3a97c1` → `v0.4.0`.
-  **U3 landed 2026-09-22** — 431 tests green (410 → 431), deployed and verified
-  live, 21/21 booth pages 200, and each of the four verbatim booths grew by
-  exactly 46 bytes, which is `len(EMBED_SCRIPT_TAG)` — one append, nothing else.
-  NOT PUSHED (push is the operator's call and he has not given it).
+  **U3 landed 2026-09-22 and released as `v0.5.0`** — 444 tests green
+  (410 → 444), deployed and verified live, 23/23 booth pages 200, and each of
+  the four verbatim booths served at exactly +46 bytes, which is
+  `len(EMBED_SCRIPT_TAG)` — one append, nothing else. `87e2c53` is the unit,
+  `5c20e2f` the panel fixes. Operator approved the minor and authorised the
+  push on 2026-09-22; **this is the first push of this repo's history** — it was
+  26 commits ahead of `origin/main` before it, so every earlier tag reached the
+  remote at the same time.
 - **U4 released as `v0.4.0`** (operator approved the minor on 2026-09-22).
   `c3a97c1` is the unit; the release commit carries the pre-existing fixes the
   bug-hunt panel surfaced in touched files. The tag waited for the last gate to
@@ -44,11 +48,11 @@ _As of 2026-09-22:_
   `persistent-memory.d/2026-09-21-u7-section-premise-half-wrong.md`: every booth
   that actually needs navigation is FLAT, so half its premise is already known
   to be wrong.
-- ⚠ **U3's RELEASE TIER IS WITH THE OPERATOR.** It reads minor — the verbatim
-  path gained a declared public API (`<script src="/_booth/embed.js" defer>`),
-  a JavaScript dependency it did not have, and an author-facing anchor syntax —
-  and **minor needs his explicit approval**. `pyproject.toml` still says
-  `0.4.0`; nothing is tagged. Do not bump it on your own.
+- **U3's tier was MINOR and the operator approved it** (2026-09-22). The
+  argument that settled it, recorded because the tie-break rule says patch: a
+  capability arrived AND one left — the verbatim path gained a declared public
+  API (`<script src="/_booth/embed.js" defer>`) and lost no-JavaScript
+  operation. That asymmetry is what made it not a tie.
 - **ALL FOUR U3 GATES ARE CLOSED.** In-session seam review (5 findings, SR-2 a
   real payload-shape bug); `/heid-contract-review`
   (`01M351WKV666D681SSRNY7D7X6`, 12 findings, 10 adopted, 2 already settled by

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "booth"
-version = "0.4.0"
+version = "0.5.0"
 description = "The Booth — a dead-simple standing web server that scans a data dir of drop-folders and renders each as an ephemeral media 'booth' (image/webm/audio auto-gallery, or a folder's own index.html verbatim). Also accepts browser/curl uploads for pickup under a human-readable id. 24h TTL, then the folder is wiped. Fleet tool for CC sessions to surface A/B and smoke results to the operator."
 requires-python = ">=3.11"
 dependencies = [