0.4.1

A testing release. The suite grows from 111 to 171 tests and line coverage from 74% to 94%, with
no source file below 75%: the command layer, the advisory feed readers and both advisory adapters,
none of which had a test before, are now covered. Two defects surfaced on the way and are fixed
below, and the composer audit fallback that the design had promised since 0.1.0 is wired in.

Added

• Tests: the command layer, driven through Composer's console application the way composer remediate runs, against the synthetic fixture. remediate: option validation (format, report
  spec, solver, release age), the lock-file check, the exit-code contract including a search budget
  too small to reach the fix, every report file format next to the JSON on standard output,
  --format=none, an unwritable report path, --fail-on, --ignore, the whole --baseline /
  --update-baseline workflow, --offline, advisory-source selection (missing snapshot, missing
  database via option, REMEDIATE_DATABASE and extra.remediate.database) and platform flags
  repeated in the recommended command. remediate:db-build from a local FriendsOfPHP checkout plus
  --include, the default build path, an unknown source; remediate:db-status on the result
  (metadata, sources, coverage gaps), on a missing file, via the environment variable, and on a
  database built before coverage gaps were recorded. Plugin capability and command registration.
• Tests: the feed readers with a scripted HTTP layer and archives built in the test. ZipArchiveReader
  (filtering, directory entries, a body that is not an archive, download failures, cleanup of the
  download); OsvDumpSource (alias ranking, ADVISORY reference as link, "MODERATE" mapped to
  medium, published/modified/withdrawn dates, several Packagist packages per document, other
  ecosystems ignored, invalid JSON and unreadable versions as coverage gaps, gaps reset per fetch,
  custom URL); PackagistApiSource (mapping, gaps, a body that is not an object, a document without
  advisories, transport failures); FriendsOfPhpSource from the GitHub archive (aliases, earliest
  branch time, non-Composer advisories skipped without a gap, scalar documents, empty ranges and
  invalid YAML as gaps naming the package from the path). The default advisory adapter
  ComposerRepositoryAdvisoryProvider with a fake Composer repository: conversion of full and partial
  advisories, per-package caching and incremental queries, merging across repositories with
  duplicate ids dropped, the failure when no repository provides advisories, transport failures,
  construction from a RepositoryManager. The composer audit fallback provider with a stand-in
  binary (leading noise before the JSON, one run per process, no JSON, undecodable JSON).
  NormalizedAdvisory, Strategy and VersionStep helpers.

Changed

• The composer audit --locked fallback adapter, described in the design decisions since 0.1.0 but
  never wired in, is now used when Composer's in-process advisory API fails with a PHP error (a
  removed method or changed signature in Composer's @internal classes). The run switches once,
  the report's advisory source shows the fallback, and a warning explains that only current-lock
  advisories are known. Lookup failures are not retried through it: no repository providing
  advisories, or a network failure, still exits with "advisory data unavailable" rather than a clean
  result. Composer older than 2.4 is still rejected up front. Covered by unit tests of the switch
  (PHP error switches and warns once, lookup failures and ordinary exceptions propagate, the primary
  is not retried) and a command test that the default source with packagist.org disabled exits 4.

Fixed

• FriendsOfPHP advisories lost their report date: the upstream files write time: 2024-05-01 10:00:00
  unquoted, which the YAML parser hands over as an integer timestamp, and the source only accepted
  text. Integer timestamps are now read, so reportedAt is populated for FriendsOfPHP records.
• Test bootstrap: Composer reads $_SERVER before getenv(), so the cache isolation was lost when
  the environment already exported COMPOSER_CACHE_DIR (DDEV does); tests now set both.