v0.5.2

Fix: a full review closes transport, discovery, limits and workflow defects.

• provider/stream: upstream hop-by-hop and stale body headers are dropped through one shared helper, so a relayed 403 or 429 can no longer forward the x-hop a Connection token names; the upstream status is kept instead of collapsing every reply to 200.
• tool-response: an upstream failure is answered with the project's own message, ABORT_ERR counts as an abort rather than a failure, and a rejected body reader is cancelled with the read error.
• models: the discovery cache is versioned (v2), read through a bounded reader instead of an unbounded one, and refetched when another version wrote it.
• limits: the profile is resolved once per sweep run (a config failure used to be retried three times and charged three requests), and --stale-after now requires digits so a date cannot supply a year.
• entries: audit, sweep, watch and capture share the "argv means script, no argv means import" rule, so importing them no longer throws on Node below 22.18.
• capture: every read target comes back through one helper.
• workflows: the gate fails when a scan stage fails (PIPESTATUS, not pipefail alone), concurrent runs are found by the newest updatedAt rather than creation order, and the PR base and compare links keep the default branch.
• bun test 773 pass, and each of the 12 files also passes on its own; CI green on Node 18.17.0 and 24.x; published to npm as 0.5.2.