v3.38.1: audit cache fixes and the VS Code extension back on the marketplaces

Changed

• fallow audit scans the temp dir for old base-snapshot caches at most once per hour. Before, each audit scanned every fallow-audit-base-cache-* entry in the temp dir. Entries of deleted repos stay until they age out, so a long-lived CI runner or developer machine can collect tens of thousands of them. With 59,000 entries, one audit of a small project took about 2.5 s instead of 0.3 s. Now the first audit in each hour scans the temp dir. The other audits sweep only the cache of their own project root. Old entries of other repos are reclaimed at most one hour later. fallow audit-cache prune still scans every entry on each run, and its output does not change. (#4020)

Bug fixes

• The audit cache sweep removes the .lock file of a cache that it reclaims (Unix). The sweep used to keep these .lock files for ever. They grew without limit, and one host had more than 15,000 of them. Every full sweep and every fallow audit-cache prune read each one. fallow audit-cache prune --format json reports a bare lock file that it removes. The report gives the new reason orphaned-lock. Windows keeps the .lock file and reports lock-only as before. (#4021)
• The VS Code extension is on the VS Code Marketplace and Open VSX again. The 3.38.0 release did not publish it, so the marketplaces still offered 3.37.0. This release publishes 3.38.1. (#4025)
• The VS Code extension bundles minimatch 11.0.3. The language client requested minimatch 10, which has a denial of service through glob pattern amplification (GHSA-g3hv-75wg-m249). The extension only matches globs that the fallow language server sends. (#4031)
• The output schema names fallow dead-code --impact-closure for affected_not_shown. The field description in the audit brief, in docs/output-schema.json and in the output contract types named fallow check --impact-closure, a command that does not exist. (#4028)

Full Changelog: v3.38.0...v3.38.1