v0.4.0

Breaking

• --links/LINKS no longer exists off Windows. It was accepted
  everywhere and did nothing off Windows — the value was only ever read
  inside a #[cfg(windows)] branch, because st_nlink arrives inside
  the statx result a Unix scan already asks for. It is now compiled
  out there, so a Linux or macOS camembert --links fails with an
  unknown-argument error instead of silently ignoring it. Migration:
  drop the flag; nothing about the scan changes, since nothing about it
  ever depended on the flag on those platforms. This matters more than
  it did before because the man page and shell completions are generated
  from the same clap definitions and are now installed by the
  .deb/.rpm/PKGBUILD packages — a no-op flag documented in terms
  of Windows would have shipped to every Linux user.
• camembert-core no longer exposes rustix::io::Errno in its error
  taxonomy, replaced by camembert_core::errno::ScanErrno — a newtype
  over the canonical POSIX errno number in Linux/x86-64 numbering.
  Tree::error_reason, Tree::error_reason_counts, Row::error_reason,
  errno::{name, from_name, label, severity, breakdown} and the dump
  reader's error_reason fields all change type. Migration: swap
  Errno::ACCESS for ScanErrno::ACCESS (the taxonomy's names are
  mirrored as associated constants), and convert a host errno at the
  boundary with ScanErrno::from(errno) on Unix. Dumps are unaffected —
  the er field's bytes are unchanged, in both directions.

Added

• Native .deb and .rpm packages, built for x86_64 and aarch64
  and attached to every release. They install the binary, the three man
  pages, and bash/zsh/fish completions. The packaged binary is the same
  static musl build as the tarballs, so the packages declare no
  dependencies and install on any glibc vintage — at the price of not
  being distro-archive-policy packages. There is no APT/DNF repository
  yet: upgrading means downloading the next release.
• Shell completions for bash, zsh and fish, generated from the live
  clap definitions by a new camembert-completions binary (the same
  pattern camembert-mangen already used for the man pages). Packagers
  and from-source installers get them with
  cargo run --release --package camembert --bin camembert-completions -- <OUT_DIR>.
• The Arch PKGBUILD (packaging/aur/) installs the
  shell completions too, and now carries options=('!lto'): makepkg's
  default LTO makes zstd-sys emit GCC LTO bitcode that rustc's linker
  cannot resolve, so the package did not build at all on a stock Arch
  configuration.
• scripts/build-packages.sh, which builds the release binary,
  regenerates the man pages and completions, and produces both packages.
  It is what the release workflow runs, so a package can be reproduced
  locally exactly as CI built it.
• A Windows scan backend (x86_64-pc-windows-msvc). camembert-core
  builds and its scan engine runs there: real allocated sizes from
  AllocationSize (measured compression-aware on NTFS), real hardlink
  dedup from NtQueryInformationByName, reparse points classified by tag,
  and paths beyond MAX_PATH. The camembert binary builds and runs
  there too, with a reduced interface: deletion, the freeable oracle and
  the open-file confidence verdict are compiled out rather than disabled,
  so the keys do not exist, ? does not list them and the palette does
  not offer them. See the README's "Platform support" for the full split.
  Prebuilt x86_64-pc-windows-msvc binaries are attached to releases as
  a .zip.
• errno::ScanErrno::SHARING_VIOLATION, the taxonomy's first non-POSIX
  reason: Windows' ERROR_SHARING_VIOLATION/ERROR_LOCK_VIOLATION, i.e.
  another process holding the file open. Its wire name is
  WIN_SHARING_VIOLATION, deliberately without an E prefix so it cannot
  be read as an errno, and non-POSIX reasons are numbered from 2^24 so the
  dump's decimal fallback can never collide with a real errno. The entry is
  unconditional, not cfg(windows): a dump written on Windows has to
  decode on Linux.

Changed

• The directory unreadable debug log renders its errno as the canonical
  name (EACCES) instead of the host's prose description (Permission denied (os error 13)). Asking the host to describe a canonical number
  would reintroduce the very numbering assumption the newtype removes.

Fixed

• The test suite is green on btrfs again. Two directory-index
  fixtures asserted their own potency ("this directory reports allocated
  index bytes, so the test can tell the corrected answer from the
  listing's zero") on every platform. That is a Windows property: the
  correction it guards reconciles a listing's resident-index zero with
  the by-handle figure, a gap only Windows has, and on Unix "a directory
  has allocated blocks" is not an invariant at all — btrfs keeps
  directory entries in metadata B-trees and reports zero for any
  directory. The guards are now Windows-only; the agreement assertions
  the tests exist for still run everywhere.
• camembert diff no longer renders a Unix path with a backslash
  separator when the dump's root is a relative directory whose own name
  contains one (camembert 'back\slash' -o dump.cmbt). The join picked the
  first /-or-\ byte in the directory path, which for such a root is part
  of a filename, and printed back\slash\plain.txt — a path that exists
  nowhere and that the dump's own d lines (back\slash/sub) contradict.
  A legacy 0.3.0 Windows dump is now recognised by its root being a Windows
  absolute path (C:\…, \\server\share, \\?\C:\…), which is the only
  shape that writer could have produced, so those still render as the
  Windows paths a user recognises.

Full Changelog: v0.3.0...v0.4.0