docs: prepare audiobook TUI 0.1.0 release

CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## 0.1.0 - 2026-08-26
+
+### Added
+
+- Keyboard-driven SSH workflow for scanning MP3 books, previewing metadata and
+  chapters, and requiring exact typed approval before conversion or review.
+- Shell-free `m4b-tool` conversion planning, ffmetadata chapter application,
+  output probing, timestamped persistent logs, and safe recovery of stale work.
+- Collision-safe ready, done, and review transitions with verified
+  cross-filesystem moves.
+- Optional unauthenticated Audnexus ASIN lookup with bounded timeouts and local
+  metadata fallback.
+- Pinned Docker/Compose packaging, numeric UID/GID execution, diagnostics, a
+  synthetic container smoke test, and Enterprise-D operator documentation.
+
+### Security
+
+- Root containment and symlink checks protect configured filesystem boundaries.
+- Existing outputs and workflow destinations are never overwritten.
+- Conversion, review, and full stale cleanup require explicit operator tokens.
+
+### Verification status
+
+- Local Python verification is recorded in the release report.
+- Docker configuration, build, doctor, and smoke acceptance remain pending on
+  Enterprise-D because Docker was unavailable in the authoring environment.

README.md

@@ -50,6 +50,23 @@ proof that Enterprise-D can pull, build, or run the image.
 
 ## Copy and install
 
+The `dist/audiobook-tui-0.1.0.tar.gz` release bundle is the preferred copy
+artifact. It contains one top-level `audiobook-tui/` directory and omits Git
+data, development caches, local environment files, runtime state/work data,
+and audiobook media. Verify the SHA-256 reported with the release, then copy
+and extract it:
+
+```sh
+shasum -a 256 audiobook-tui-0.1.0.tar.gz
+scp audiobook-tui-0.1.0.tar.gz Enterprise-D:/opt/
+ssh Enterprise-D
+cd /opt
+tar -xzf audiobook-tui-0.1.0.tar.gz
+cd audiobook-tui
+```
+
+If copying the source tree instead, exclude local artifacts:
+
 From the machine containing this project, copy it to Enterprise-D without local
 caches, state, or audio:
 
@@ -207,10 +224,11 @@ for investigation or select the displayed artifacts and confirm cleanup. The
 application does not resume ambiguous work or delete outside the configured
 ready and work roots.
 
-Persistent conversion logs are written beneath the directory mounted at
-`/app/state`, normally `./state/logs` on Enterprise-D. Back up logs if they are
-part of your audit trail. Conversion work and generated chapter metadata live
-beneath persistent `/app/state/work`, normally `./state/work` on Enterprise-D.
+Persistent conversion logs use UTC-timestamped names beneath the directory
+mounted at `/app/state`, normally `./state/logs` on Enterprise-D. Back up logs
+if they are part of your audit trail. Conversion work and generated chapter
+metadata live beneath persistent `/app/state/work`, normally `./state/work` on
+Enterprise-D.
 The entrypoint creates that work directory only after confirming the mounted
 state directory is writable by `PUID:PGID`. Interrupted work therefore survives
 container removal and remains available to the TUI's explicit stale-recovery