release: prepare 0.1.0b1

[cport1]

Prepares 0.1.0b1 (PEP 440 beta). No changes to the webdecoy_ai_protection package code since 0.1.0a1; this moves the package's maturity label to beta and lets the publish workflow release betas.

What changed

• pyproject.toml: version = "0.1.0b1".
• README.md: "Alpha preview" -> "Beta", "this preview" -> "this beta" (two places), install line ==0.1.0b1.
• examples/requirements-ollama.txt: pin webdecoy-ai-protection==0.1.0b1 (this install only works once 0.1.0b1 is on PyPI).
• .github/workflows/publish.yml:
  • The version guard was assert 'a' in version (alpha only). It is now re.fullmatch(r'\d+\.\d+\.\d+(a|b)\d+', version), so it accepts aN and bN and still rejects final, rcN and .devN versions. Publishing is still pre-release only.
  • Default version input 0.1.0a1 -> 0.1.0b1; display name "Publish Python alpha" -> "Publish Python pre-release". The file name (publish.yml) and pypi environment are unchanged, so the PyPI trusted-publisher config still matches.
• New CHANGELOG.md with a 0.1.0b1 entry covering what landed since v0.1.0a1 (docs: runnable and tested Ollama budget example #1: runnable Ollama budget example, its tests against pinned ollama==0.6.3, README section; ollama added to the dev extra only) plus this release prep.

Test results (local, same steps as ci.yml)

• python -m unittest discover -s tests: 64 tests OK on Python 3.11, 3.12, 3.13 and 3.14
• ruff check src tests examples: all checks passed
• ruff format --check src tests examples: 16 files already formatted
• python -m build: built webdecoy_ai_protection-0.1.0b1.tar.gz and webdecoy_ai_protection-0.1.0b1-py3-none-any.whl; wheel METADATA and sdist PKG-INFO both say Version: 0.1.0b1
• twine check --strict dist/*: PASSED for both
• Ran the workflow's "Verify release version" script locally: passes for 0.1.0b1, still passes for an alpha (0.1.0a2), rejects 0.1.0.

Publish steps (after approval)

1. Merge this PR.
2. Make sure the repo variable PYPI_TRUSTED_PUBLISHING is true (otherwise the publish job is skipped after the build).
3. Run the publish workflow from main:

   gh workflow run publish.yml -R WebDecoy/ai-protection-python --ref main -f version=0.1.0b1
   gh run watch -R WebDecoy/ai-protection-python   # pick the "Publish Python pre-release" run

   It reruns CI (3.11-3.14), verifies the version, builds, runs twine check --strict, then publishes to PyPI with trusted publishing in the pypi environment (approve it there if the environment requires a reviewer).
4. Tag and create the GitHub pre-release, as was done for v0.1.0a1:

   git fetch origin && git tag -a v0.1.0b1 origin/main -m "0.1.0b1" && git push origin v0.1.0b1
   gh release create v0.1.0b1 -R WebDecoy/ai-protection-python --prerelease \
     --title "Python SDK 0.1.0b1" --notes-file release-notes.md   # paste the 0.1.0b1 section of CHANGELOG.md

5. Verify on PyPI:

   curl -s https://pypi.org/pypi/webdecoy-ai-protection/0.1.0b1/json | python3 -c 'import json,sys; print(json.load(sys.stdin)["info"]["version"])'
   python -m venv /tmp/wd && /tmp/wd/bin/pip install 'webdecoy-ai-protection[fastapi]==0.1.0b1' && /tmp/wd/bin/python -c 'import webdecoy_ai_protection'

   https://pypi.org/project/webdecoy-ai-protection/0.1.0b1/ should list it as a pre-release. Because the project has no final release yet, pip may select it even without --pre or a pin.