feat: add delete and delete_trace; drop preview language (1.4.0)

[rferreira]

Final leg of the delete fan-out — all 8 SDKs are at the split-delete surface after this.

Three commits, the last one separable.

1. delete / delete_trace (4d34a5b)

Propagates the openapi v2.2 delete endpoints (scanii/openapi#46, superseded by #48). The Aug 30 spec change split what was originally a cascading delete — the two resources are independent:

• DELETE /v2.2/files/{id} — removes the processing result only
• DELETE /v2.2/files/{id}/trace — removes the trace only

A customer deleting a result must not assume the findings went with it.

• Scanii::Client#delete(id) → true on 204
• Scanii::Client#delete_trace(id) → true on 204
• Both raise Scanii::Error on 404 (which is also what a repeated delete of the same id returns) and Scanii::AuthError on 401/403, via the existing raise_for_status
• true matches the existing #delete_auth_token and Java's boolean, so parity and local convention agree
• VERSION 1.3.1 → 1.4.0 in lib/scanii/version.rb per CLAUDE.md §6

2. Drop the "v2.2 preview" language (same commit)

Docs only — no behavior change. The spec only ever marked the trace GET as preview; process_from_url was a plain 2.2 feature, so labelling it preview was drift. The trace endpoint's marking has since been removed from the contract itself (scanii/openapi#49, merged).

Removed from the retrieve_trace / process_from_url RDoc, the TraceResult class doc, the README table, and the test section comments. Historical CHANGELOG entries left intact as a record of what shipped.

3. Path-segment encoding fix (e88a5dd) — separable, not part of the delete work

Kept as its own commit so it can be dropped without touching the rest.

url_encode fed every id-taking method through URI.encode_www_form_component, which renders a space as +. That's right for a form body and wrong in a path, where + is a literal plus — so delete("a b") requested /files/a+b and the server would look up the id a+b. URI.encode_uri_component gives %20.

Surfaced by a url-encoding assertion I added for #delete. Affects retrieve, retrieve_trace, delete, delete_trace, retrieve_auth_token and delete_auth_token equally. Not reachable with server-generated ids, which are hex — so this is latent, not a live bug. URI.encode_uri_component needs Ruby ≥ 3.1; the gemspec floor is 3.4.

Tests

6 integration tests against scanii-cli hard-asserting the split (new surface → no self-skip): result deleted while trace survives; trace deleted while result survives; repeated delete raises; unknown id raises for both; empty id raises ArgumentError.

10 unit tests via WebMock for what integration can't isolate: HTTP verb, exact path, id url-encoding, and 404/403 error mapping. The 403 case (temporary auth tokens aren't privileged to delete) is covered deterministically.

Verification

All three CI gates locally on Ruby 4.0.3 against scanii-cli v1.12.0:

• bundle exec rake test — 84 runs, 193 assertions, 0 failures, 0 errors, 1 skip (pre-existing test_callback_delivery self-skip)
• bundle exec rubocop — 18 files, no offenses
• gem build scanii-ruby.gemspec — builds scanii-ruby-1.4.0

Plus a consumer-install smoke test, since CI never installs the artifact the way a customer does (the scanii-go lesson): installed the built gem into a throwaway GEM_HOME and ran the split flow from there rather than the source tree — delete_trace → trace nil, result intact; delete → Scanii::Error (404).