v4.8.0

Nuthatch 4.8.0 makes a first run reach its data in seconds, keeps a published mirror consistent with
what it holds, lets an operator finalise an archive nest's last segments, and makes the exact float
sum cheaper. It is a minor because of the new publish finalise subcommand and because init now
refuses a wrong-chain --rpc instead of leaving it for dev.

First run

A keyless endpoint that accepts connections and never answers cost the README quickstart about 60 s
in a clean Linux container: its chain-id check timed out but left it marked healthy, so dev's first
call and two of init's waited on it too (#1885).

• An endpoint whose chain cannot be verified is cooled and kept only as a last resort, and the check
  takes at most 2 s.
• init probes chains with a 2 s per-request limit and fails over, and reports a chain where no
  endpoint answered as unreachable rather than absent.
• init verifies chain ids before its tip lookup, so a wrong-chain --rpc fails there.

The quickstart, run as written in a clean ubuntu:24.04 container: 70 to 72 s before, 10 to 11 s
after.

Publishing

• The mirror's catalogue matches its objects (#1851). Provisional segments were withheld from the
  mirror while its manifest.json still listed them, so a reader was handed entries it could not
  fetch. The published catalogue now leaves them out, and publish verify compares against it.
• nuthatch publish finalise --dir <nest> [--yes] lists each table's provisional tail and, with
  --yes, marks them final so the next publish sync uploads them. It rewrites no file and keeps
  every hash, and it refuses while anything holds the nest's nuthatch.redb. A table whose chain has
  gone quiet, or any table of an archived nest, never folds its tail, so this is how that data gets
  published.
• sealed_through in a mirror is the highest block any published segment reaches; a quiet table's
  withheld tail can sit below it, and the reader docs say so.

Engine

• The exact float sum's partial stage is 2.8 to 4 times faster on 50 million doubles, with identical
  results; its state is now fixed-width columns.
• A missing column with no near match, or a quoted name, is reported cleanly instead of with a
  garbled qualified name, so the closest-column hint works for it too.
• The engine's own build is smaller: release binary 168.0 MB to 158.2 MB.

Operations

• The release gate compares floats exactly, now that two fresh servers give identical answers on every
  production gate set (#1883), and refuses to run under a jq older than 1.7.
• CI measures tip lag on every PR and fails when the median from a block being seen to its rows
  answering exceeds 30 ms (#1884). Backfill throughput is tracked and not gated (#1723).

Compatibility and upgrade

Replace the binary and restart. There is no storage migration or re-index. init given a --rpc on
the wrong chain now fails there rather than leaving it for dev.