Pre-release verification: fix two checks that reported more than they did, and cut 0.2.0

[jehrr]

A pass through the repo against the family notes, by code rather than from memory. Four things were not what they reported, and the repo had no tag.

Fixed

The fixture privacy check examined an empty string. test_no_capture_leaks collected its corpus with k.startswith("FIX_"), but every fixture in the suite is named by suffix — SEARCH_FIXTURE, US_LISTING_FIXTURE, eight more. The generator matched nothing, so all twelve patterns (JWTs, session ids, click-tracking keys, DataDome blobs) ran against "".

Twelve checks reported PASS over 150 KB of committed real captures that nothing had looked at.

before:  the string the privacy checks actually scan is 0 chars
after:   PASS  the privacy checks below have fixtures to scan (10 fixtures, 150487 chars)

The captures are clean — with the collection fixed, all twelve still pass. This changes no committed data; it changes whether we know that. The real fix is the assertion added underneath, which fails if the corpus is ever empty again.

The banned-wording scan reached only the repo root. os.listdir(REPO_ROOT) left eight shipped files unscanned: both Claude workflows, tests.yml, canary.yml and the four issue templates — the files most likely to attract product wording. It asks git ls-files now, which also excludes untracked scratch and .pytest_cache for free, with the old behaviour as a fallback for a non-git tarball.

The canary's header described a schedule that its own body, forty lines further down, explains it does not have.

The README did not state that pyppeteer is effectively unmaintained, though the engine table recommends it as one of the two engines that reach Etsy.

Release 0.2.0

There was no tag at all. pyproject.toml said 0.1.0, the CHANGELOG documented a 0.1.0 release and linked to releases/tag/v0.1.0, and on a public repo that link was dead. v0.1.0 will be tagged retroactively at the rewrite commit it describes; this is v0.2.0.

0.2.0 rather than 0.1.1 because two changes are user-visible, and the notes lead with them: diff_runs.py now refuses a cross-currency comparison, and the canary is dispatch-only.

Verified against the family notes, not assumed

Checked by reading the code, not by recalling it. Already correct: all 23 family flags in all three engines · the status→exit mapping shared through finish_run · every bare sys.exit literal is exit 2 · --proxy refused with --cdp-endpoint in all three engines · --fingerprint warned in the two that have it · link[rel="next"] leading the selector list · MIN_CARD_MATCHES 5 · pages_failed recorded by number · diff_runs refusing an incomplete run · all four grouping spaces pinned by literal-character tests · .env.example parity in both directions · both Claude workflows token-gated and pinned to stable · the concurrency test covering all five behaviours the notes ask for.

Checks

571 offline checks (was 569), 0 failures. ci_checks.py --all clean. pytest wrapper passes.