chore(release): prepare 0.2.2

[sathariels]

Prepares jevcheck 0.2.2 from main 694da05 (v0.2.1, already on PyPI). This pull request does not tag, open a GitHub Release, or upload to PyPI.

This supersedes Dependabot #10, #12, and #18.

Summary

• Lock typesafe-sdk at 0.7.4. The pyproject.toml floor stays typesafe-sdk>=0.7.0. Changelog and diff for 0.7.1–0.7.4 are bug fixes, an optional http2 extra, stricter request validation, and non-finite JSON serialization. Successful System One calls and response adaptation are unchanged, including integer score-map keys.
• Fold in the Action bumps, still pinned by commit SHA the way the workflows already pin them:
  • actions/checkout 4.2.2 → 7.0.1 (3d3c42e5aac5ba805825da76410c181273ba90b1), supersedes chore(deps): bump actions/checkout from 4.2.2 to 7.0.1 #10
  • actions/setup-python 5.6.0 → 7.0.0 (5fda3b95a4ea91299a34e894583c3862153e4b97), supersedes build(deps): bump actions/setup-python from 5.6.0 to 7.0.0 #12
  • hashgraph-online/ai-plugin-scanner-action 1.2.635 → 1.2.777 (6f088dedc8f1f035eddd1597de8eacd8262a3862), supersedes chore(deps): bump hashgraph-online/ai-plugin-scanner-action from 1.2.635 to 1.2.777 #18
• Checkout v5+ and setup-python v6+ run on Node 24 and need Actions runner v2.327.1 or newer (ubuntu-latest qualifies). Checkout v7 refuses fork-PR checkouts only for pull_request_target and workflow_run; these workflows do not use those events. persist-credentials: false is unchanged. setup-python v7 removes pip-install, which nothing here sets. python-version is unchanged. The scanner bump is a patch; plugin_dir, min_score, and fail_on_severity are unchanged.
• Each P1/P2 finding in docs/release-readiness-audit-v0.1-recheck.md is marked Resolved in be58041 (v0.2.0) after checking that commit against the current tree. The README no longer points at the recheck as open.
• Eval tests cover tolerance edges, multiple expectations, error paths, and boundaries. pytest-cov is on the dev extra. CI prints a coverage report and does not fail on a threshold.
• Version 0.2.2 is set in pyproject.toml, jevcheck.__version__, and the Action jevcheck-version default. .github/workflows/jevcheck-example.yml still installs published jevcheck==0.2.1 so that PyPI install stays green until the post-merge upload.

Bug found

evaluate() called require_pinned and ignored the stripped pin. A concrete candidate such as jev-1.14 passed the pin check and then failed identity against response model jev-1.14. It now identity-checks the stripped value, matching the CLI.

Local checks

python3 -m compileall -q src tests
# exit 0

python3 -m ruff check tests
# All checks passed

python3 -m pytest --cov=jevcheck --cov-report=term-missing -ra --override-ini='addopts='
# 147 passed, 1 skipped in 0.67s
# TOTAL 909 statements, 80 missed, 91%
# src/jevcheck/eval.py 183 statements, 2 missed, 99%

The skipped test is tests/test_live.py (TYPESAFE_API_KEY unset). The project has no configured linter. python3 -m ruff check src tests reports 13 pre-existing findings outside this change.

Python 3.12.3, pytest 9.1.1, pytest-cov 7.1.0, coverage 7.16.2.