docrot-scan-api v1.4.0 — edge-safe error statuses (502/504 -> 404/403/503)

v1.4.0 — Edge-safe error statuses (breaking HTTP codes, unchanged error.code)

Problem: the contract promises machine-readable JSON errors — honest, never hidden — but this deployment sits behind Cloudflare, and the edge replaces origin 502/504 response bodies with a 16-byte plain-text page. Verified by a temporary edge probe: 403, 404, 424, 429, 500, 503 pass through byte-intact; 502 and 504 do not. Exactly the upstream-failure cases the contract cares about were silently losing their error.code in production while origin and 4xx responses were fine.

Remap (same error.code, new HTTP status):

error.code	was	now
repository_or_ref_not_found	502	404 (also semantically true)
repository_not_public	502	403
upstream_error, archive_unreadable	502	503
fetch_timeout, fetch_interrupted, upstream_unreachable	504	503
duration_exceeded	504	503

Clients: branch on error.code, not HTTP status — the code values are unchanged.

Docs: docs/API.md error table updated; new "Why no 502/504?" section records the probe evidence; changelog note marks the change as breaking.

Verification: edge probe (temporary nginx locations, removed after measuring), suite 119/119 green, live re-test of the previously-broken 502 path after deploy.