Tenderseed v2.2.2

This release carries no behaviour change. Every point below is a place where
the code and its documentation had drifted apart, plus two lines that make an
existing invariant structural instead of contractual. The binary does the same
thing on the network as v2.2.1.

Fixed

• bench.sh reported zero failed checks whatever happened. It counted a
  per-address line emitted at debug level, while the default log level is info,
  so the figure was structurally zero unless the home under test had been
  switched to debug. The verification figures now come from the sweep summary
  line, which is emitted at info level, and the script says that a run shorter
  than one period yields no such line.
• :latest only moves forward. The container workflow pushed :latest on
  every version tag, so a patch released on an older line would have overwritten
  it with the older build, silently. The tag is now published only when it is
  the newest one, and the job says so when it declines.
• The outcome counter cannot publish a pair the summary line would not
  report. Both sinks were guarded differently: the internal counter by
  membership of the outcome list, the Prometheus one by nothing. A future caller
  passing an unlisted pair would have created a series no summary line could
  ever mention, which is what that line promises is impossible. One guard now
  covers both.

Documentation

• The comment anchoring peer_check_period still named GetSelection, the
  very draw that v2.2.1 replaced and documented as the wrong one. It now names
  neither, since the ceiling is the same for both, and points at the sweep for
  the bias.
• FORK.md said an evicted address never comes back through GetSelection. True,
  but named a function the sweep no longer calls: an evicted address is out of
  the book, so no selection can return it.
• skipped_local was documented as three exits and covers five, the two extra
  ones being the defensive nil guards at the top of verify. Both the README
  table and FORK.md now say so.

Build

• go.sum joins the build dependencies in the Makefile. A dependency bump that
  touches only go.sum would have left make believing the binary was current.

Updating

Only the binary is replaced. Node identity, configuration and address book are
untouched. No configuration key was added, removed or renamed, and no metric
series changed. See the update procedure in the README.