Prepare MKCKKS Go2Py v0.2.0 release candidate

[NeilYXIN]

Summary

Prepare MKCKKS Go2Py v0.2.0 as a NumPy-first Python binding over the pinned MKHE-KKLSS implementation.

This refactor introduces a versioned native ABI with opaque handles, real and complex NumPy support, multi-chunk processing, evaluator operations, distributed decryption, serialization, typed errors, resource limits, and correctness-range tracking. It also adds packaging, documentation, examples, and focused CI/release workflows.

The protected upstream Go implementation remains pinned to commit 13fed55fd28270fb4345dd532da24b323ebc5ce3 and is verified byte-for-byte through UPSTREAM.lock.

Major changes

• Added support for float32, float64, complex64, and complex128.
• Added scalar, plaintext, and ciphertext arithmetic; rotation; conjugation; rescaling; and level management.
• Added multi-party evaluation keys and collective decryption.
• Added deterministic serialization for contexts, keys, plaintexts, ciphertexts, and shares.
• Added opaque native handles, lifecycle management, fork protection, and typed failure handling.
• Added conservative magnitude/error tracking for chained circuits.
• Added source and platform-wheel packaging with uv and scikit-build-core.
• Added comprehensive examples, documentation, licensing provenance, and project governance files.
• Added minimal GitHub CI and manually triggered release-candidate workflows.

Correctness and verification

Locally verified:

• Protected upstream integrity at commit 13fed55.
• Protected and bridge Go test suites.
• Go vet and race-focused tests.
• Go bridge-core coverage: 95.08%.
• Python tests: 73 passed with 95.43% branch coverage.
• All 31 public C ABI symbols and operational tests.
• Direct-upstream differential and generated chained-circuit tests.
• Ruff formatting/linting, strict mypy, and REUSE compliance.
• Executable notebook and distributed-process example.
• Clean wheel installation, serialization, evaluation, and collective decryption.

The full cross-platform, fuzzing, reproducibility, and 10,000-cycle lifecycle gates will run through the manual release-candidate workflow after merge.

Security and licensing

• No protected upstream cryptographic file has been functionally modified.
• The new wrapper, bridge, tests, and documentation are MIT licensed.
• The bundled upstream implementation remains CC BY-NC 2.0.
• The combined distribution is therefore noncommercial source-available research software, not OSI-approved open source.
• This release provides engineering correctness evidence but is not a formal verification or independent cryptographic-security audit.

Compatibility

This is a v0.x breaking refactor. Users needing the original double-only wrapper can continue using commit 7870ebb. Serialization envelope 1.0 and native ABI v1 become the compatibility baseline for v0.2.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.