chore(release): v0.4.3

[dean0x]

Release-surface trigger

This PR touches three of the six RELEASE_SURFACE paths — crates/mds-napi/package.json, crates/mds-napi/Cargo.toml, crates/mds-python/Cargo.toml — so release.yml runs automatically on the pull_request event and verify-pr-checks.mjs requires Version gate, Stage + verify platform packages and Rehearse PyPI publish (no upload). The CI-history gate is step-skipped on pull_request, so ONE manual gh workflow run release.yml --ref release/v0.4.3 follows ci.yml completion. Two Release runs on this head are expected.

Lockfile recipe and residual gates

Bump: node scripts/bump-version.mjs 0.4.3 → ✓ bumped 14 files to 0.4.3 (never touches lockfiles, never .rs files).

Lockfile refresh:

• cargo update -w → 5 workspace-crate lines (mds-cli, mds-core, mds-napi, mds-python, mds-wasm each v0.4.2 -> v0.4.3)
• npm install --package-lock-only --ignore-scripts

Residual gates, both EMPTY:

• Cargo.lock: numstat 5 5; the only changed lines are version = "0.4.3" ×5; getrandom stays untouched at version = "0.4.2"; zero ^[-+]name = lines — no third-party crate moved.
• package-lock.json: numstat 19 19; the only changed lines are 8 workspace "version": "0.4.3" entries plus 11 "@mdscript/…": "^0.4.3" internal dependency ranges — zero third-party packages moved.

No --before retry was needed for either gate.

since gate

grep -rn 'since = ' crates/ --include='*.rs' → exactly one hit: crates/mds-core/src/lint/fix.rs:746: since = "0.4.0", — 0.4.0 <= 0.4.3.

Version gate

node scripts/verify-versions.mjs → ✓ version gate: 8 packages + 4 crates all at 0.4.3; no file: refs; internal deps pinned to ^0.4.3; Python pyproject.toml name=markdown-script version=dynamic.

Lock consistency

The root package.json is private: true with no name field, so the lockfile's root "name": "mdl" line is npm's checkout-directory default. It is never published. The lockfile was refreshed lock-only (--package-lock-only --ignore-scripts) and never regenerated from scratch.

Snyk

Snyk code scan unavailable (MCP ENOENT); no security/snyk check ran on this head.

What ships

Two BREAKING CLI changes land in this release:

• build: empty directory build exits 0 — silent success hazard in CI #204: mds build/check/fmt/lint now exit non-zero on a directory with no .mds files.
• mds build/check/fmt/lint <dir> exits 0 when the only .mds files are partials (_foo.mds) — same silent-green shape as #204 #387: mds build <dir>/mds check <dir> now exit 1 when every .mds file in the directory is a _-prefixed partial.

The full [Unreleased] CHANGELOG body is now stamped as ## [0.4.3] — 2026-09-17, with fresh compare links ([Unreleased]: …/compare/v0.4.3...HEAD, [0.4.3]: …/compare/v0.4.2...v0.4.3).

Local pre-flight (RELEASING.md) passed in full:

• cargo fmt --all --check and cargo clippy --workspace --all-targets -- -D warnings (including --features startup-race-probe) clean
• cargo nextest run --workspace 2364/2364, plus 53 doctests
• RUSTDOCFLAGS="-D warnings" cargo doc -p mds-core --no-deps clean
• MSRV check (cargo +1.88 check) clean
• cargo publish -p mds-core --dry-run → aborting upload due to dry run
• npm workspace builds + tests all green (bundler-utils 91, mds 304, rollup 17, rspack 26, vite 24, webpack 21, mds-napi 115 — 0 failures)
• test:gates 220/0
• source-hygiene gate clean across 566 files
• ledger-citation gate clean across 551 files / 1217 tokens
• local cp311-abi3 wheel built with maturin 1.13.3; install smoke printed Hello CI!; pytest 247 passed, 3 skipped (mypy/pyright not installed), 6 deselected

Dependabot hold

Do not merge any Dependabot PR while this is open — six of the eight touch package-lock.json.