lockvet v0.3.12

lockvet v0.3.12 — Hex registry signals: the BEAM world gets its metadata layer

deps.dev has no Hex system, so until now Elixir and Gleam diffs had
vulnerability data but nothing else — no ages, no deprecations. Like
Packagist for PHP, hex.pm isn't a double-check here: it is the
metadata layer. One anonymous GET per changed package against hex.pm's
CORS-open packages API (so the browser playground
gets every signal too):

• Release ages and the ⏱ cooldown flag from each release's
  inserted_at — -fail-on fresh now works for mix.lock and Gleam's
  manifest.toml.

• Retired releases land in the deprecation lane with the
  maintainer's reason and message:

  ↑ httpotion  3.1.0 → 3.2.0  minor  (4y old)
      ● deprecated upstream: retired: deprecated — Not really maintained, please check out Tesla
  

• Registry-verified unlisted detection — hex.pm deletes releases only
  in the first hour after publish (or by admin action against malware),
  so an incoming version missing from the index while the package's other
  versions are listed earns the ▲ flag.

• Verified changelog links — the upstream repo from the package's
  hex.pm links powers tag-to-tag compare links and -changelogs.

• Hex keeps no per-release license history, so license-change detection
  is honestly skipped for this ecosystem.

Also in this release:

• Renamed forks resolve correctly: mix.lock's map key is the OTP
  application name; the Hex package name is the atom after :hex.
  "chatterbox": {:hex, :ts_chatterbox, …} now reports (and queries
  OSV/hex.pm for) ts_chatterbox — fixing phantom ▲ flags and advisories
  matched against the wrong package's versions.
• Private Hex repos and Gleam git/path packages are exempt from all
  registry judgments.

Registry lineup: npm · PyPI · crates.io · RubyGems · Packagist · NuGet · Hex.

Validated on 75 real mix.lock commits across plausible/analytics,
livebook and supabase/realtime: 0 failures, 0 false unlisted flags.