release 1.29.0

[maximilianfeix]

Version 1.29.0 in proxyscraper/__init__.py and server.json, changelog section dated today.

Minor bump: --serve-open is a new option, and a password-less --serve-host off loopback now refuses to start instead of warning (a deliberate, documented behavior change for security; compose.yaml is unaffected).

Since 1.28.0:

• Security: no accidental open proxy – --serve-host needs a password or --serve-open (serve: no open proxy by accident – --serve-host needs a password or --serve-open #328)
• Security / supply chain: --require-hashes on locked CI installs, Docker base image pinned by multi-arch digest with Dependabot docker, mcp-publisher verified by sha256 in the release job (ci: --require-hashes for the locked installs, base image pinned by digest #329)
• Fixed: a clock-dependent test that failed since 2026-10-12 (tests: discovery expiry test no longer depends on today's date #327)
• Docs: docs/MAINTENANCE.md, a maintenance log with the audit notes and the backlog

Verified locally: ruff clean, 1089 passed / 10 skipped, uv build → proxy_scraper_cli-1.29.0-py3-none-any.whl + sdist, wheel installed into a clean venv reports proxy-scraper 1.29.0 and lists --serve-open.

After the merge: tag v1.29.0 on the squash commit – the release workflow tests, builds, signs with Sigstore, creates the GitHub release, moves v1, publishes to PyPI and the MCP registry.