v0.2.0

What changed

Detector behaviour in this release:

• FastAPI auth: auth inside a dependency's body (a 401 or 403 raised by a repo function or class) now counts, as do guard decorators such as @requires_login, role checkers, and cookie parameters.
• Route forms: websocket routes, add_route, add_websocket_route, call-form registration, a bare Depends(), lambda endpoints, keyword include_router(router=...), aliased and star imports, and aliases inside string annotations are now followed.
• Public paths: /public is a public path. A root route under a public mount is public, and a mount prefix does not hide a route's own path.
• Monorepos: imports resolve to the service that owns the importing file.
• GitHub Actions: jobs named on, yes, no or null keep their names. timeout-minutes: 0 is no longer a timeout. Comments no longer move step line numbers. Skipped workflow files are reported on stderr.
• Robustness: a detector calling sys.exit or printing no longer breaks the scan or --json output. Malformed context is rejected per detector.

Full details are in the commit history from v0.1.1, and in docs/detectors.md.