0.3.3 — the ratchet can't silently disengage

Two fixes, both about riskratchet telling the truth.

An unreadable baseline no longer passes the gate

load_baseline trusted .riskratchet.json completely. Every way that file could be wrong degraded to
zero entries — and an empty baseline passes every gate. check and diff printed "No risk
regressions detected" and exited 0 on a baseline that ratcheted nothing.

.riskratchet.json	before	after
version newer than this build reads	exit 0	exit 2, upgrade riskratchet
entries missing or not an array	exit 0	exit 2
not a JSON object	AttributeError traceback, exit 1	exit 2
some entries malformed	exit 0, silently dropped	runs, warns with the count

version had been parsed and checked by nothing. doctor reported PASS (0 entries) on a corrupt
file; it now fails, and a baseline from a newer riskratchet gets "upgrade" rather than a "regenerate"
that would have destroyed it.

Reading v1/v2/v3 baselines is unchanged, so upgrading never forces a re-baseline.

riskratchet was under-reporting its own coverage by 7.6 points

The pytest11 entry point imported the package before pytest-cov started its tracer, so every
module-level line read as "missing" — 83.3% measured against 91.1% real. Internal only: no effect on
your repository's scores, since your coverage source never includes riskratchet's own modules.
fail_under rose 74 → 85 and the baseline dropped 119 of 400 entries, all downward.

Compatibility

Non-breaking. No CLI flag, JSON field, schema field, or import removed or renamed. The one behavior
change — exit 2 where a broken baseline used to exit 0 — can only turn CI red for a repository whose
ratchet was already not working.

GitHub Action users: riskratchet-action@v1
already points here.

Full notes: CHANGELOG.md