Merge pull request #944 from DeusData/fix/dryrun-hardening

cli: compute self-update checksum in-process (portability)

Keep the publish chain alive when the soak stage is skipped

With soak_level=none the soak job is skipped; release-draft already
handles that with an explicit condition, but verify and the publish
jobs relied on the default success() check, which treats a skipped
ancestor as non-success and silently skips the whole publish chain.
Give each downstream job an explicit condition that only blocks on
real failures or cancellations.

Document the Java, Kotlin, and Rust hybrid LSP resolvers in the README

Adds the three v0.8.0 resolver rows to the Hybrid LSP capability table.

Document the Java, Kotlin, and Rust hybrid LSP resolvers in the README

Adds the three v0.8.0 resolver rows to the Hybrid LSP capability table.

release: bump pkg/npm + pkg/pypi to v0.7.0

The release.yml workflow publishes both wrappers as-is from the repo;
they were still pinned to 0.6.1, which made the npm publish step try to
republish v0.6.1 instead of v0.7.0.

release: bump pkg/npm + pkg/pypi to v0.7.0

The release.yml workflow publishes both wrappers as-is from the repo;
they were still pinned to 0.6.1, which made the npm publish step try to
republish v0.6.1 instead of v0.7.0.

fix(release): atomic publish — un-draft GH release only after registr…

…ies succeed

Previously the un-draft step ran inside the verify job, before
publish-registries. If npm or PyPI publish failed, the GitHub release
was already live but the wrappers were not — half-shipped state.

Move the un-draft into a new publish-final job that needs both
[verify, publish-registries]. If any registry fails, the GH release
stays in draft and the run can be re-tried with replace=true.

fix(release): atomic publish — un-draft GH release only after registr…

…ies succeed

Previously the un-draft step ran inside the verify job, before
publish-registries. If npm or PyPI publish failed, the GitHub release
was already live but the wrappers were not — half-shipped state.

Move the un-draft into a new publish-final job that needs both
[verify, publish-registries]. If any registry fails, the GH release
stays in draft and the run can be re-tried with replace=true.

Fix VirusTotal gate: accept completed scans with < 60 engines

VT's status=completed is final — no more engines will report. The script
was polling indefinitely when ARM binaries only reached 50/76 engines.
Now accepts any completed scan, logs a NOTE when below MIN_ENGINES.

Fix VirusTotal gate: accept completed scans with < 60 engines

VT's status=completed is final — no more engines will report. The script
was polling indefinitely when ARM binaries only reached 50/76 engines.
Now accepts any completed scan, logs a NOTE when below MIN_ENGINES.