fix: online-first articles were flagged as year mismatches

[musharna]

CrossRef carries up to four date fields and published holds the earliest. _year() returned the first field it found, so for any journal that publishes online before print the canonical year was the online one — and a bibliography using the print year, which is how those papers are universally cited, was reported Tier B.

Found while auditing a 25-entry bibliography: 2 of 25 entries were flagged and both were correct.

DOI	online	print	cited as
10.1093/bioinformatics/btt656	2013-11-13	2014-04-01	Liao et al. 2014
10.1093/molbev/msu343	2014-12-21	2015-03-01	Yang et al. 2015

Acting on either flag would have introduced a defect into a clean bibliography — the opposite of what this tool is for. A false positive here is worse than a miss, because it costs the reader's trust in every other flag, and this class covers most journals rather than an edge case.

Change

CanonicalRecord now carries years — every distinct year CrossRef holds for the DOI, earliest first — and a claimed year is a mismatch only when it matches none of them. year still holds the earliest and is unchanged for display. When a mismatch is reported for a multi-date record, the message names them all ("CrossRef years are 2013/2014").

Verification

• Tests written before the fix and watched to fail (AttributeError: no attribute 'years').
• Positive control: a year matching neither date is still Tier B; single-date records behave exactly as before.
• Real execution: the live CLI against the same 25-entry bibliography now reports 2 C · 1 U and no Tier B, with cosmetic and unverifiable findings correctly retained.
• 316 tests pass, ruff clean.
• Version bumped in all three places that pin it; git grep caught __init__.py and CITATION.cff, which a pyproject-only bump would have left reporting 0.5.2.