neckbeard 1.12.7

• The hook search reads the whole tree, and says so when it cannot. An independent review after 1.12.6 shipped found that its new search for hook-shaped JSON stopped four directory levels down and reported has_hooks: false for hooks below that, which is the silence 1.12.6 set out to remove. There is no depth limit now; a budget of 20,000 JSON reads bounds the walk (the largest of 128 local repos read 5,378 in about 3 seconds, with no false alarms), and running out says where it stopped: unknown if nothing was found by then, and the hooks found so far with a search_incomplete note if something was. A marketplace.json that is not valid JSON, or that was refused, now says so in the dossier instead of reading as a marketplace that lists nothing. Four self-check cases: the first and last fail against 1.12.6, and the partial-result case was added after a second review round found that gap; see CASE-STUDIES.md §15.