chore(release): cut 1.0.3; reconcile changelog; pin pypi-publish action

Bump core, generic and typescript to 1.0.3 (php/python unchanged at 1.0.1,
skipped at publish via skip-existing). Carve the stale "Unreleased" changelog
into real 1.0.0/1.0.1/1.0.2 sections and add 1.0.3. SHA-pin
pypa/gh-action-pypi-publish (was floating @release/v1). Add the
/release-habit-hooks skill.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

refactor(config): replace pydantic with attrs for a pure-Python core

Config parsing used pydantic (which pulls the Rust pydantic-core), forcing a
`depends_on "rust"` build and fragile, platform-specific Homebrew bottles.
The config models do only typed loading + defaults + ignore-unknown-keys
leniency — no real validation — so port them to attrs and a small recursive
loader that filters each dict to its declared fields. The core dependency
tree is now pure Python (attrs, jinja2, pathspec), enabling a universal
Homebrew bottle. Bumps core to 1.0.2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(sensors): invoke bundled Python helpers via sys.executable

Bundled Python sensors ran their helper scripts with a bare `python`,
which fails on any environment without `python` on PATH (stock macOS,
clean CI, Homebrew-isolated installs) — the sensor errors and
habit-sensors exits non-zero across every install channel.

Add a `${python}` placeholder that expands to the interpreter running
habit-sensors (`sys.executable`, shell-quoted), and use it for the
line-count, jscpd, deptry, and phpmd sensor commands. A regression test
runs a bundled sensor with `python` scrubbed from PATH.

Bumps core, generic, python, and php to 1.0.1 (typescript unchanged).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci(release): tolerate partial publishes during bootstrap

PyPI caps pending trusted publishers at 3 per account, so the five
projects must be created in two batches. Set fail-fast: false so a
package that has no publisher yet does not cancel its siblings, and
skip-existing: true so re-running after the remaining publishers are
registered never trips over already-uploaded versions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

habit-hooks v0.2.0