v5.3.8

v5.3.8

Fixes since v5.3.7 (see CHANGELOG.md for full detail):

• #68 — exit code 3 "no-scan" contract: an empty scan can no longer pass CI silently.
• #69/#71 — --emit-findings-json escapes quotes and control characters correctly (Rust).
• #70 — Rust embedded analyzers honor the module's filtered file list (--exclude, --strict-gitignore, --exclude-tests).
• #75/#76 — TS type-narrowing: exclusions forwarded to the helper; continue/break treated as guard exits; graceful fallback when the typescript package lacks the compiler API.
• #77/#84 — inline ubs:ignore honored on archive entry-path findings and at count time (suppressed findings drop from totals and exit code).
• #79 — --version reports the UBS install's own git suffix, not the caller's cwd.
• #81 — Elixir/Ruby scanned-file counts no longer depend on awk NUL handling.
• #85 — Rust constant-time comparison detector no longer flags parser/domain vocabulary (candidate == "BR2"-style parser tokens); two-tier strong/weak sensitivity vocabulary with security qualifiers and metadata exemptions.

Verification:

export UBS_MINISIGN_PUBKEY="RWS+jJ7psytzl3v4znpraY9VWBQrICXBFmT3VwvxpTzbuV2Q/CBTDmVJ"
minisign -Vm SHA256SUMS -P "$UBS_MINISIGN_PUBKEY" -x SHA256SUMS.minisig

Note: this release was built and signed from the tagged commit on trusted local infrastructure (GitHub Actions is currently unavailable for this account). The GHCR OCI image and its oci-sbom.spdx.json / oci-provenance.json attestations are deferred until Actions is restored; all other assets match the standard release layout.