Harden CI and release artifacts

docs/development.md

@@ -2,7 +2,7 @@
 
 ## Requirements
 
-- Go 1.24 or later
+- Go 1.25 or later
 
 ## Setup
 
@@ -53,9 +53,14 @@ The current tests cover:
 - JSON -> XLSX -> JSON round trip
 - structured -> structured conversion without CLI/file I/O
 - extension normalization and format inference
-- ragged table row padding
+- short table row padding and wider-row rejection
 - conservative cell type inference, including zero-padded identifiers
-- conflicting unflatten paths
+- whitespace and UTF-8 BOM preservation rules
+- invalid UTF-8, duplicate keys, and trailing-data rejection for JSON
+- multi-document YAML streams and empty-record table boundaries
+- wrapper arrays with sibling metadata
+- duplicate, blank, malformed, and conflicting headers
+- nested arrays and JSON-quoted path keys
 
 When adding a new format or path rule, add tests around both directions where
 possible.
@@ -67,14 +72,18 @@ Gitea Actions workflows live under `.gitea/workflows`.
 - `ci.yml`: runs on pushes to `main`, pull requests, and manual dispatch.
 - `release.yml`: runs on `v*` tag pushes and manual dispatch with a `tag` input.
 
-The CI workflow checks formatting, runs tests, builds the CLI, and performs a
-small YAML -> TSV -> JSON smoke test.
+The CI workflow checks formatting, runs tests and `go vet`, scans reachable
+vulnerabilities with `govulncheck`, builds the CLI, and performs a small
+YAML -> TSV -> JSON smoke test.
 
 The release workflow runs tests, cross-builds release archives for Linux,
 macOS, and Windows on amd64/arm64, writes `checksums.txt`, creates or reuses a
 Gitea Release, and uploads the generated assets. It uses the built-in
 `${{ secrets.GITEA_TOKEN }}` provided by Gitea Actions.
 
+Release binaries receive their tag through the `main.buildVersion` linker
+variable. Verify an extracted native binary with `dataxl -version`.
+
 ## Release Notes
 
 Create a release by pushing a version tag: