Add Zenodo citation metadata and release verification

[bernalde]

Summary

• add schema-valid DWave.jl citation metadata using the existing Zenodo concept DOI
• add the concept DOI badge and distinguish package, ecosystem-article, and exact-version citations
• add a release checklist that preserves the existing concept record and records the two-steward governance gate
• add a bounded release-triggered verifier that fails when Zenodo's latest archive does not match the GitHub release tag
• add focused tests for citation consistency, archive drift, retry behavior, and transport failures

Live archive evidence

• GitHub latest release: v0.7.6 (published 2026-06-30)
• Zenodo concept DOI: https://doi.org/10.5281/zenodo.7812066
• Zenodo v0.7.6 DOI: https://doi.org/10.5281/zenodo.21078136
• Zenodo concept record ID: 7812066
• Zenodo version record ID: 21078136

The public Zenodo record confirms that v0.7.6 is the latest published version under the existing concept DOI. Zenodo collaborator-management access is not exposed sufficiently by the public record to verify that two active maintainers have Can manage access.

Acceptance criteria

• Concept DOI 10.5281/zenodo.7812066 remains authoritative.
• At least two maintainers can manage the deposit. This remains a human Zenodo-account check; record the stewards and review date in Standardize JuliaQUBO citation policy and restore Zenodo archiving QUBO.jl#66.
• README and schema-valid CFF expose consistent citation guidance.
• The release process detects if Zenodo falls behind GitHub releases.

Because the deposit-manager criterion remains externally unverified, this PR uses Refs #69 rather than closing the issue. Once two stewards are confirmed and recorded in the ecosystem tracker, issue #69 can be closed.

Validation

• julia --project=. -e 'using Pkg; Pkg.test()': passed; QPU tests skipped because no valid D-Wave API token was available, while the classical sampler and repository suites passed
• julia --project=. test/citation.jl: 23/23 focused assertions passed
• mutation check: inverting the release/version comparison made 5 of the 10 drift-detection assertions fail, confirming stale archives cannot pass vacuously
• env ZENODO_VERIFY_ATTEMPTS=1 ZENODO_VERIFY_DELAY_SECONDS=0 julia --project=scripts scripts/verify_zenodo_release.jl v0.7.6: matched DOI 10.5281/zenodo.21078136
• cffconvert --validate --infile CITATION.cff (cffconvert 2.0.0): valid against CFF schema 1.2.0
• actionlint .github/workflows/zenodo.yml: passed
• GitHub Markdown rendering preserved the citation links and DOI badge; the badge SVG displays 10.5281/zenodo.7812066
• actions/checkout@v7 and julia-actions/setup-julia@v3 tags were verified through the GitHub API

Branch Hygiene

• Base branch: main
• Source branch: docs/issue-69-zenodo-citation
• Branch point: 60f54b76cb4620592b67ae5bdf442fdb63f0617a
• Stacked: no
• Prerequisite PRs: none
• Open-PR file overlap immediately before push: none

Refs #69

[bernalde]

Maintainer review

No actionable findings at a84dc39c0351b5833ff6c4c0e54adaf9807aaa75.

I reviewed the complete changed-file set and linked issue #69. The CFF uses the existing concept DOI as the evergreen software identifier, the README distinguishes direct package citation from the QUBO.jl ecosystem article and exact-version archives, and the PR correctly uses Refs #69 because the two-steward Zenodo access criterion remains an external human check.

The release workflow is limited to release and manual dispatch events, uses read-only repository permissions, reads no secrets, and does not execute contributor-controlled code in a privileged event context. The verifier checks the concept record and release version, bounds retries, reports transport failures, and uses a minimal scripts environment rather than DWave.jl's Python-backed runtime.

Validation reviewed:

• julia --project=. -e 'using Pkg; Pkg.test()' passed; QPU tests were skipped because no valid API token was available, while the classical and repository suites passed.
• 23/23 focused citation and verifier assertions passed; inverting the version comparison made five drift-detection assertions fail.
• cffconvert validated CFF 1.2 metadata, actionlint accepted the workflow, the rendered DOI badge showed 10.5281/zenodo.7812066, and the live verifier matched v0.7.6 to 10.5281/zenodo.21078136.
• All four required GitHub CI lanes passed on the reviewed head.

The PR is ready for human review from an automated code-review perspective. This is a COMMENT because the authenticated account is also the PR author; it is not a formal human approval. Branch protection requires the four checks and conversation resolution but currently requires zero approving reviews.