chore(release): release v0.4.2 (#496)

[jafreck]

Release

Closes #496. Prepare @jafreck/lore@0.4.2 for programmatic consumers including AAMF.

• Bump package.json and both root version markers in package-lock.json from 0.4.1 to 0.4.2 without changing dependencies.
• Add README upgrade/pinned-install guidance and architecture notes explaining unchanged schema v3 and the need to rebuild older native baselines before strict certification.
• Publish GitHub release/tag v0.4.2 only after this PR merges. The published release event triggers .github/workflows/publish.yml and trusted npm publishing.

Changes Since v0.4.1

Features

• Host-owned SCIP language/file scope intersected with WalkerConfig, scoped launches/imports/refresh, filtered C/C++ compilation databases, and canonical scope provenance (feat(indexing): add trusted SCIP scopes (#492) #493).
• Typed required-symbol and resolved-call validation contracts, persisted and enforced before promotion and during later revalidation (fix(validation): enforce compiler diagnostics and required facts (#494) #495).

Fixes

• Compiler diagnostics are captured and enforced even when scip-clang exits zero. Failed/skipped translation units or incomplete output capture reject generated indexes; prior promoted baselines remain intact (fix(validation): enforce compiler diagnostics and required facts (#494) #495).
• The real zstd verifier supplies the explicit macOS SDK and verifies compiler evidence plus the required call relationship (fix(validation): enforce compiler diagnostics and required facts (#494) #495).

Documentation and Tests

• API, CLI, execution-trust, provenance, and upgrade guidance for the new scoped validation behavior.
• Focused trust, execution denial, scope, diagnostics, native compiler-failure, and semantic-fact regression tests.

Verification

On Node.js 22.22.1:

• All package/lockfile version markers verified as 0.4.2.
• npm run build: passed.
• npm run typecheck: source and first-party tests passed.
• npm test: 2,087 passed, 76 skipped.
• npm publish --dry-run --loglevel=warn: passed; only existing bin/repository URL normalization warnings.
• Documentation contracts: 64 passed.
• git diff --check: passed.

Compatibility and Limits

Schema v3 and execution grants are unchanged. Older executed native baselines without compiler-diagnostic evidence must be rebuilt for strict/migration-grade validation. Precomputed C/C++ indexes retain an unverified-compilation warning; custom wrappers must expose their compiler diagnostics. The upstream scip-clang repeated-header reference-loss bug is not fixed here, and exact reference-count equality is not an acceptance criterion.

Previous release: v0.4.1.
Implementation range: v0.4.1..36aec6e1dad030df5ee019567a90058553fcf0a3.
Release branch compare: v0.4.1...release/v0.4.2
Final release compare: v0.4.1...v0.4.2

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.48%. Comparing base (36aec6e) to head (d08f4f8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #497   +/-   ##
=======================================
  Coverage   91.48%   91.48%           
=======================================
  Files          92       92           
  Lines       11276    11276           
  Branches     3649     3649           
=======================================
  Hits        10316    10316           
  Misses        960      960           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.