hecatron 0.5.0

• Leave files out of formatting: "format": {"exclude": [...]} lists
  paths hct format and hct lint's format check skip (a fixture
  misformatted on purpose, generated code), where hecatron gives the
  formatter its files.
• A missing linter says so: hct lint with a language's linter not
  installed (golangci-lint, say) reports the toolchain missing (exit 3), and
  "command not found" leads the failure's excerpt.
• init detects better: a build file at the root keeps its language
  there unless the directory the layout names for it holds the language's
  code (in a repository with go.mod at the root and a languages/go/ of
  other files, Go lives at the root, not in languages/go/), and files
  under hooks/ are tooling, not a language (a Tcl hook script no longer
  adds Tcl). Applies to hecatron init and to a repository read without a
  config.
• hct licenses: every dependency's license, in every language and
  component, from the lock files (OSV-Scanner with deps.dev for npm, PyPI,
  Go, crates.io, Maven, NuGet and RubyGems; composer.lock for PHP):
  rolled up per SPDX license, each package with its version, direct or
  transitive and dev marked, unknown licenses apart, and what isn't covered
  said so. A "licenses" policy in the config (allow, deny, ignore
  with a reason and an expiry, includeDev) fails the command on a package
  it refuses; hct check validates it. --output human|agent|json. Needs
  the binary (#132).
• CI jobs get a time limit: hecatron workflows adds
  timeout-minutes: 60 to each generated GitHub job that sets none, and
  timeout: 60m to each GitLab job, so a hung job stops after an hour
  instead of GitHub's 6. Set it for the project or
  per language in .hecatron/config.json
  ("ci": {"timeoutMinutes": 30, "languages": {"pascal": 120}}); a
  template's own timeout-minutes stands. Every generated workflow
  changes once: run hecatron workflows after upgrading, or
  hecatron check reports them out of date.
• An Agent Skill for hecatron: AI agents that read Agent Skills learn
  hecatron without the docs: first steps, the test-lint-format loop, exit
  statuses, asking before installs, and what to do when something fails.
  In Claude Code: /plugin install hecatron --marketplace dnf/hecatron; in
  claude.ai, upload the release's hecatron-skill.zip.
• More of hecatron runs in the binary, and faster: toolchain version
  resolution and each language's environment (hct test across 8
  languages × 3 components: 0.28 s of setup to 0.07 s), init and the
  other project commands (check, add, remove under 10 ms), and
  doctor's checks (1.6 s to 0.6 s for 8 languages). Same output as
  before, checked byte for byte.
• macOS fixes: Ruby installs when Homebrew's ruby-build lags (it uses
  ruby-build's repository, as on Linux); Fortran's doctor checks gfortran,
  so --fix installs it; Scala's smoke test uses Scala CLI's flag; Ada sets
  SDKROOT from xcrun, so GNAT links when the Command Line Tools are
  newer than the selected Xcode.
• Elixir on Linux installs Erlang's development files, so dependencies
  that compile Erlang sources (leex, yecc) build.
• OCaml installs every opam package's dependencies, for a repository
  with several .opam files too.
• hct skill install: puts hecatron's Agent Skill where an agent finds
  it: ~/.claude/skills (the default), the repository's .claude/skills
  (--project, to commit) or another agent's skills folder (--dir).
  Reinstalling replaces hecatron's own copy and nothing else.
• hct status: what to know first in a repository, in one command:
  hecatron's version, whether the config is saved or detected, and for each
  language its directories, the toolchain version it resolves to and why,
  whether that toolchain is installed, the last run of each action, and its
  uncommitted changes; then the commands worth running next, marking those
  that install something. --output human|agent|json, chosen as for
  hct test. Needs the binary that releases ship (#121).
• hct advisor: where hct doctor keeps the machine working, the
  advisor reads the project and recommends what each language's ecosystem
  considers good practice, each finding with what to change, why, and a
  link to the ecosystem's own documentation: lock files committed (with each
  ecosystem's nuance: Cargo binaries, Composer projects, Dart and Ruby
  applications) and package-lock.json still matching package.json,
  toolchains pinned in the ecosystem's own file and not past end of life
  (from the release tables hecatron ships), a formatter and linter
  configured, Gradle's build and configuration caches, npm ci in CI, CI
  covering every language, GitHub Actions not pinned to a branch, and audit
  acceptances past their date. Rules are data in each language definition
  (advice.json); rules for 23 definitions so far. Reads files only;
  --fix adds missing pin files at the version in use; --fail-on recommended|suggestion for CI; "advisor": {"ignore": [...]} in config,
  validated by hct check. Needs the binary (#105).
• GitLab CI and caching in generated CI: hct workflows writes a
  .gitlab-ci.yml with a job per language (install, test and lint through
  hct) when generated.ci is "gitlab" (or ["github", "gitlab"], or
  with --ci gitlab), and hct check fails when it falls behind. With
  "ci": {"cache": true} the generated GitHub workflows and GitLab jobs
  cache each language's toolchain (keyed on its pin files and hecatron's
  version) and dependencies (keyed on its lock files); each definition
  lists the directories in its new cache key. Off by default, so existing
  workflows don't change. Needs the binary (#102).
• Dependabot and Renovate configuration: with generated.dependabot
  (or generated.renovate), hct workflows writes .github/dependabot.yml
  with an updates entry for each package ecosystem and component
  directory (renovate.json with the managers and paths), merging the
  project's dependabot (or renovate) settings, and hct check fails
  when a language or component was added without regenerating it. Each
  definition names its ecosystems in new dependabot and renovate keys.
  Needs the binary (#103).