v2.0.0-rc.5

Features

• Added R2-backed trait bundle updates with sha256 verification, atomic install, pin/check/update support, and
  signed manifest publishing.
• Updated to filefacts 0.9.5 and stng 1.6.0 for richer package, PE/CLR, Mach-O, PE import, and string-extraction
  signals.
• Added archive routing for package ecosystems like gem, npm, crate, conda, egg, NuGet, IPA, VSIX, Android/
  Alpine APK, and Arch/FreeBSD pkg.
• Archive/outer-scoped composites can now pool findings across archive members, useful for browser extensions
  and split payload packages.
• JVM bytecode imports now include owner-qualified symbols like java/lang/Runtime.exec.
• npm script capability checks moved toward YAML traits for more precise per-hook supply-chain features.

Performance

• Trait update artifacts now use .tar.zst bundles instead of git clones/pulls.
• Manifest generation now compat-tests release versions and HEAD, caches validation, and supports pre-publish
  integrity checks.
• Archive members now share the same encoded-payload processing path as standalone files instead of duplicating
  logic.

Bugfixes

• Fixed archive members missing encoded-payload findings and decoded payload recursion.
• Fixed archive members skipping XOR extraction, which weakened detection inside npm/zips/jars.
• Tiny structured manifests under 100 bytes now still evaluate KV/value traits.
• UTF-16 test matching now normalizes text like production analysis.
• Office external-template findings now distinguish remote injection targets from benign local template paths.
• IP matching no longer lifts false IPv4 hits out of OIDs or long version strings.
• Edge extension update URLs are treated as first-party, avoiding Chrome extension false positives.
• Embedded-code evidence offsets now map back to parent-file line proximity correctly.