Develra v0.1.2

Develra v0.1.2 adds bounded Python lockfile resolution while preserving the
local-first scanner's existing privacy and determinism guarantees.

Added

Resolve direct dependency versions from poetry.lock, uv.lock, and
Pipfile.lock when a supported Python manifest exists in the same directory.
Normalize PyPI package names before correlating manifest and lockfile data.
Keep ambiguous, non-registry, and marker-specific resolutions on their
manifest evidence instead of guessing a locked version.
Report malformed, orphaned, or unsupported lock inputs with at most one
concise diagnostic per file.

Locked transitive packages do not become direct dependencies. Default scans
remain offline and never execute project code or package tooling.

Updated the synthetic Python fixture to requests 2.33.0 and urllib3
2.7.0, resolving dependency alerts in test data. These packages are fixture
text only and are not installed or executed by Develra.

npx develra@0.1.2 --version
npx develra@0.1.2 scan

Use the compatible Action channel in GitHub workflows:

- uses: develra-dev/develra@v0
  with:
    command: check