v0.21.0

Eight issues closed, the unit suite made offline by default with a real network
suite alongside it, and the 6,062-line test module split by subsystem.

Added

• check --full compares each local kernel against the server (#15).
  check only asked whether a file of each name existed, so a file holding the
  wrong content counted as present. On juice_crema_5_2_v473_20260819_001.tm it
  reported "Found locally: 102/102" while 10 kernels differed from the server,
  one of them a 245 MB DSK present as 11 MB.

  Size is compared first, one HEAD per kernel, which already proves two files
  differ. --hash additionally compares sha256 for kernels whose size matched,
  and --spice furnshes every local kernel and reports what SPICE cannot read.
  The command exits 1 when anything is wrong. New: KernelDB.verify_against_server().

• A real network test suite (tests/test_network.py): 11 requests against
  NAIF and ESA covering probe classification, both directory-listing formats,
  size queries, and ESA's TLS handshake timing. Marked network and deselected
  by default, so pytest -m network runs them deliberately.

Fixed

• check resolves a bare metakernel name before parsing it (#11)
• get and update accept -v, and update's help matches get's (#3, #4)
• probe_url distinguishes absent from unreachable (#10): a 404 from a
  healthy server no longer reads the same as a server that never answered
• Explicit timeouts on every urlopen (#12), so a stalled connection fails
  rather than hanging indefinitely
• CI moved off the deprecated Node 20 actions

Changed

• The legacy database lookup is gone. A legacy file is no longer picked up
  silently; it raises LegacyDatabaseFound with migration instructions.
• Unit tests are hard-offline by default, enforced by a socket guard rather
  than hoped for. One test had been opening six real TLS connections to
  naif.jpl.nasa.gov whose failures were swallowed, so the assertions never
  depended on them. Blocking the sockets changed no assertion, which is the
  argument for blocking them: 23.1 s to 9.4 s, and CI no longer needs JPL to be up.
• tests/test_kernel_db.py split into test_remote.py, test_cli.py,
  test_metakernel.py, test_db.py and test_regressions.py. Every branch had
  been appending to the same two files and colliding; the 337 collected test IDs
  are byte-identical before and after.

Full notes: CHANGELOG.md