since-cutoff 0.3.2: 721 tests, and the bugs they found

[MohammadHijjawi97]

since-cutoff 0.3.2 is on PyPI (uvx since-cutoff@latest scan). This one is about test quality, and the new tests found real bugs.

• 721 tests (up from 481), with line and branch coverage at 92.9% and a 91% floor enforced in CI.
• Property-based tests and fuzzing (Hypothesis) for cutoff parsing, model ids, release selection, the archive path guard, notes apply/remove, statistics and every lockfile parser.
• Golden tests on real dependency files from 10 open-source projects (uv, Poetry 1 and 2, PDM, Pipfile, pip-compile with hashes, pyproject with git references and markers).
• Tests that catch breaks: a reviewer broke the code 63 different ways; every break now makes a test fail.
• OpenSSF Scorecard, with every GitHub Action pinned by commit.

Bugs the new tests found, all fixed: a memory blow-up when reading oversized wheel metadata; a TLS drop mid-download that crashed the scan; a race when publishing the source cache while a file is locked (antivirus); an unclear message when a download exceeds the limit; openai-compatible wrongly requiring OPENAI_API_KEY; crashes on non-JSON API replies; and several parsing bugs found by fuzzing and by the real lockfiles. Details in the changelog.

Next is 0.4.0: scan will lead with the changed APIs your code actually uses, write notes from the API diff with no model and no API key (each tagged with exactly what was checked), and sync will keep them current when your lockfile changes.