v1.0.0-rc.38

Release candidate 38. Republishes rc.37's content on a rebuilt Go native-distribution
model plus additional publish-pipeline and extraction fixes.

Go native distribution (download-at-consume)

• The packages/go module no longer ships native binaries in the module zip. A cmd/setup
  tool downloads the platform FFI library from the release assets into the user cache and
  writes a machine-local cgo link shim. A per-version RequireNativeSetup_<version> sentinel
  turns a module/native version mismatch into a compile error.

Publish pipeline

• Ship SHA-256 sidecars for the Go FFI release assets.
• Forward the app token to the publish-zig action (fixes the 403 upload).
• Slim the C# NuGet meta package (fixes the 413 on publish).
• Pin Maven 3.9.16 in the release workflow.
• Link libbz2 on macOS/iOS for the Swift package (resolves BZ2 symbols).

Library

• Add a job cancellation endpoint (DELETE /jobs/{job_id}) (#1313).
• Emit structured table elements for CSV.
• Validate OpenDocument ZIP metadata during MIME detection.
• PaddleOCR honors rec_batch_num and aligned CTC dictionaries; angle-rollback recognition
  is batched.

Tooling

• Registry-mode smoke suite runs against pre-releases; PHP smoke installs the native
  extension first.
• Python integration uv.lock files refreshed.