v0.4.1 — Bug Audit: 16 fixes

v0.4.1 — 2026-07-05 · 16-bug audit

🔴 Critical (6 fixes)

• CI: ruff lint now fails on error (removed continue-on-error)
• CI: script tests fail the pipeline (removed || true)
• CI: SHA-pinned all actions (checkout@de0fac, setup-python@ece7)
• CI: isolated build (removed --no-isolation)
• Removed stale CLI/MCP copies (scripts/arc_builder_cli.py, mcp_server.py)
• ArcDocsClient: httpx → stdlib (removed undeclared dependency)
• tests/test_core.py: rewritten for current API

🟡 Medium (5 fixes)

• mcp_server.py docstring: 9 → 11 tools
• README.md + docs/builder-tooling.md: version pins updated
• doctor.py: import os at module top
• x402_client.py: removed unused imports

🟢 Security

• Arc chain-id check before eth_call in get_usdc_balance()
• Payment Intent Demo: CSP/SRI, 1 USDC limit, typed confirmation, one-shot send

🧪 Tests: 45/45 PASS | Ruff ✓ | Secret scan ✓ | twine check ✓