fix: review findings from initial scaffold

[NormallyGaussian]

Summary

Closes the gaps from four parallel reviewers (code, tests, docs, workflows) and the extended live smoke against api.parallel.ai. Two real bugs would have shipped broken in 0.0.1 — both caught and fixed here.

Bugs fixed

enrich was broken end-to-end. The SDK rejects JSON-Schema dicts via task_run.execute(output=…) (it accepts only Pydantic classes or strings). Routes via beta.task_run.create + task_run.result instead, with the discriminated-union envelope the API requires:

client.beta.task_run.create(
    input={"objective": ..., "inputs": ...},
    processor=...,
    task_spec={"output_schema": {"type": "json", "json_schema": <schema>}},
)
result = client.task_run.result(run.run_id, api_timeout=int(timeout_s))

Verified live — returns run_id + cited basis.

extract(full_content=True) was broken. Top-level full_content is rejected by the SDK; it lives inside advanced_settings. The original smoke only tested False (the default), so this would have hit the first user who flipped it. Fixed + regression test added.

Code quality

• Tool names are now public — web_search, web_fetch, extract, deep_research, enrich. The leading-underscore variants confused LLMs and didn't match the doc-published names.
• Submodules renamed to _search.py / _extract.py / _task.py to avoid attribute-vs-submodule shadowing in the package namespace.
• Tracing plugin keys per-call timing on ToolContext.function_call_id (concurrency-safe across overlapping sessions) and adds on_tool_error_callback so timing entries don't leak when tools error out.
• __version__ read from importlib.metadata — fixes the 0.0.1 vs 0.1.0 drift the reviewers flagged.
• Dropped the untested enrich_with_model helper.

Packaging / CI

• parallel-web>=0.5.1 (was >=0.3 — broken on older), google-adk>=1.31.
• Documentation URL points at the GitHub README until a real docs page exists.
• auto-release.yml reads head_commit.message via env var, not direct ${{ }} interpolation — closes a shell-injection vector via crafted commit messages.
• release.sh refuses to run off main, refuses if the release tag already exists.
• README + integration docs: StreamableHTTPServerParams (doesn't exist) → StreamableHTTPConnectionParams.

Tests

• New test_search.py, test_extract.py, test_task.py with monkeypatched SDK clients. Covers call shapes (max_results in advanced_settings, full_content nesting, enrich JSON parse errors, _format_result branches).
• Tracing tests: added concurrent-call test (distinct function_call_id keys don't race) and an error-path test for the new on_tool_error_callback.
• Live smoke moved to tests/integration/; default pytest no longer needs --ignore flags.
• 8 → 29 unit tests.

Verification (run on the HEAD of this branch)

Check	Result
pytest -v	29/29 passed
ruff check + format --check	clean
Live smoke vs api.parallel.ai	all 5 tools end-to-end — _enrich direct returns run_id + cited basis; Gemini Flash picks web_fetch and extract with correct citation_count traces

Sequencing

Should merge before PR #1 (the 0.0.1 release). Otherwise 0.0.1 ships broken on PyPI. Once this lands, PR #1 needs a rebase or a re-open on top of main.