release(0.4.1rc2): post-quantum hybrid signing (ML-DSA + Ed25519)

Promotes the PQC module (PR #153) into a published pre-release so
pip install --pre attestix carries hybrid post-quantum signing via the
optional [pqc] extra. Classical Ed25519 path unchanged.

Author: ascender1729

CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to Attestix are documented here.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.4.1rc2] - 2026-06-16
+
+Pre-release. Adds post-quantum signing on top of 0.4.1rc1. `pip install --pre attestix`.
+
+### Added
+- **Post-quantum / hybrid signing** (`attestix.auth.pqc`, optional `[pqc]` extra):
+  FIPS 204 **ML-DSA-65** sign/verify over the shared JCS canonical form, and a
+  **hybrid Ed25519 + ML-DSA-65** composite where a verifier MUST validate BOTH
+  signatures (anti-stripping / weak non-separability), so attestations stay
+  verifiable after a quantum break. `did:key` Multikey encoding for ML-DSA-65.
+  The default Ed25519 path is unchanged. Cryptosuites: `mldsa65-jcs-2026`,
+  `hybrid-ed25519-mldsa65-jcs-2026`.
+
 ## [0.4.1rc1] - 2026-06-16
 
 Pre-release. Security hardening from a multi-persona audit. Available on the

attestix/__init__.py

@@ -29,7 +29,7 @@
     - attestix.errors: Centralized error categories and structured logging
 """
 
-__version__ = "0.4.1rc1"
+__version__ = "0.4.1rc2"
 
 # Re-export submodules for convenient access
 from attestix import services

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attestix"
-version = "0.4.1rc1"
+version = "0.4.1rc2"
 description = "Attestix - Attestation Infrastructure for AI Agents. DID-based agent identity, W3C Verifiable Credentials, EU AI Act compliance, delegation chains, and reputation scoring. 47 MCP tools across 9 modules."
 readme = "README.md"
 license = {file = "LICENSE"}