### wai-quantum 0.5.0: provenance, sampling members, device programs, and three more members

Breaking: `Certificate` gains a public field, `provenance`, and `FabricClass` is now
`#[non_exhaustive]`, so a class can be added in a minor release. A silicon certificate
hashes exactly as before; every pinned digest is unchanged. The `quantum_fabric` feature now
includes `quantum_toolchain`.

- **Provenance in the certificate.** `Provenance::{Silicon, Emulator(name), Simulator(name)}`,
  inside the certificate's hash unless it is silicon. Placement ranks silicon first, then
  emulators, then simulators, so a simulated member never stands in for hardware that is
  present.
- **Sampling members.** The kernels `wai.quantum.circuit/sample` and
  `wai.quantum.circuit2/sample`, the `Sampler` trait, `certify_sampler` (classical fidelity
  against the exact distribution, over stated shots) and the `qpu-v1` corpus. `VirtualQpu`
  samples a stated noise model (global depolarizing and readout flips) and says it is a
  simulator. `VirtualDevice` adds a coupling map and a native basis: each circuit is
  compiled, the program verified, and the gate errors charged for the program it would
  run, routing included.
- **Programs for devices** (`quantum_toolchain`). `device::device_qasm` writes OpenQASM 2
  or 3 in the dialect's standard gates only, with every multi-controlled gate lowered
  exactly (dyadic angles throughout; refused, never rounded, past the table) and every
  qubit measured into `c[i]`; `counts_from_bitstrings` and `counts_from_integers` read a
  service's counts back. `native::compile` targets a processor's own basis (`rz`/`sx`/`x`/`cz`,
  `prx`/`cz`, or `gpi`/`gpi2`/`zz` in turns) on its own qubits, routed over its coupling
  map; `NativeProgram::verify` checks a program against its circuit by simulation before
  it is sent. `from_qasm` now reads `ch`.
- **The OpenCL member** (`quantum_fabric_opencl`, opt-in): the exact 64-bit kernel in
  OpenCL C, built by each device's own compiler; the ICD loader is opened when first used.
  Certified bit-exact on GPUs and CPUs of several vendors; an OpenCL accelerator is refused,
  since no fabric class names it.
- **The FPGA member, simulated** (`quantum_fabric_fpga`, opt-in): the datapath in Verilog,
  each 32×32 product from four 16-bit partial products, compiled at run time by Verilator
  into a cycle-accurate simulation. Its certificates say they were earned in a simulator.
- **The dense f64 state vector on accelerators** (`quantum_fabric::sv64`, with
  `quantum_sv`): the CPU's own launches (diagonal with the exact-one skip, the one-qubit
  formula, and ordered row sums), each an IEEE binary64 operation with no fused
  multiply-add, on the CUDA member (`CudaMember::sv`) and on OpenCL devices with binary64
  (`OpenClMember::sv`). Certified against the pinned corpus digest `SV_DEFAULT_PIN`; a
  device without binary64 refuses, saying so.
- **wai-quantum-qpu 0.1.0** (new crate): clients for three quantum processing protocols
  (`sampler_v2`, `prx_circuits`, `native_turns`), each compiling exactly to the device,
  verifying before submission and reading counts back onto the circuit's qubits;
  `QpuSampler` makes a service a fabric member; the `wai-qpu` command reads a device,
  runs the bit-order probe, and certifies. `curl` is the transport, with secrets kept off
  command lines. Tested against services that follow each protocol's published contract.
- **CI.** Workflows for the OpenCL member, the simulated FPGA member and the QPU clients;
  the CUDA and OpenCL hardware jobs certify the f64 state vector; the hardware host
  declares its devices in its runner's environment.

