feat: 🔀 Promote Collector diagnostics and capture improvements - #87

Report the verification limit in XLog search and capture output. Refs #57.

Clarify the profile warning for error text that can contain sensitive values. Refs #63.

Expose stored object hashes through object list --date. Refs #59.

Expose stored service and error dictionary text through the existing XLog search opt-in. Refs #60.

Add recorded timing, parent steps and network outcomes to live profiles. Refs #61.

Enforce Linux line and branch coverage thresholds and publish test reports. Refs #72.

Refs #76.

Refs #64.

Report actionable path errors for transaction capture and offline inspection, including regular-file ancestors, while preserving atomic creation, existing data and integrity failures.

Refs #75

Retry transient Windows access-denied atomic replacements and distinguish local file errors from Collector transport errors. Preserve committed checkpoints and document recovery limits.

Refs #58

Provide command-specific help, clean redirected and NO_COLOR output, and safe option-name diagnostics while preserving CLI execution contracts.

Refs #65

Collect committed transaction IDs during the existing validated traversal, preserving integrity and recovery while removing the extra prefix scan. Add reproducible local I/O measurements and document remaining scaling limits.

Refs #74

## Why

Profiles with repeated SQL can produce hundreds of kilobytes of JSON.
Add the single aggregate option retained by the issue's triage.

Refs #62

## Changes

`profile get --group-sql` and offline `inspect --group-sql` return SQL
hash groups with execution count, total/max elapsed milliseconds and
error count. Statements still require `--include-text`; unresolved or
conflicting dictionary text is explicit. The summary includes
decoded-step counts, lossless transaction IDs and original completeness
metadata. English and Korean guides explain the output and limits.

In a synthetic wire fixture with 3,000 repeated SQL steps, live output
with text fell from 667,803 bytes to 501 bytes. Default individual-step
output remains available.

## Validation

- Full Linux `coverageCheck verifyReleaseInputs`: passed; 266 executable
test cases, line coverage 95.38%, branch coverage 80.95% (90%/80%
minimums).
- Native Windows JDK 21: 10 new packaged-CLI scenarios and 6 aggregate
tests passed.
- Actual CLI comparisons against the previous build: byte-identical
default live/inspect output and capture files; previous strict reader
accepts new captures. Verified text redaction, unchanged capture bytes
after inspection, late-page corruption rejection, truncation,
unavailable profiles and command-option validation.
- Baseline and deliberate aggregation mutations demonstrated that the
new tests detect missing functionality, overflow and incorrect redacted
statement output.

Validation used synthetic local TCP fixtures; no external
Collector/Agent deployment was tested.

## Compatibility and risks

The opt-in payload declares `scouterctl.profile-sql-summary/v1`;
existing result envelopes, default outputs, capture formats and
exit/completeness semantics are preserved. Grouped output omits
individual chronology and non-SQL details. Size grows with distinct SQL
hashes; this does not reduce upstream transfer/decoding or prove trace
completeness. Duration totals count decoded steps and are not
transaction wall time.

## Why

Update the Java setup and GitHub Script actions while preserving the
artifact API required by local act runs.

## Changes

- Update `actions/setup-java` from v6.1.0 to v6.2.0 and
`actions/github-script` from v8 to v9.0.0, pinned to full commit SHAs.
- Keep the three act-only artifact uploads on v4.6.2. Hosted uploads
already use v7 and remain unchanged.
- Synchronize the branch with current develop, including SQL grouping.

## Validation

- act v0.2.97 workflow validation passed; both workflows and reusable
job graph resolve.
- Ran the actual comment script with v9's pinned execution function on
Node24 across seven scenarios, including creation/update, stale/closed
PRs, missing/oversized reports and report content treated as text.
External GitHub API calls were replaced locally.
- Confirmed upstream tags/SHAs, Node24 runtime and retained input
compatibility.

Full local act execution was unavailable because Docker Desktop's Linux
engine/WSL integration is unavailable. No environment settings were
changed. Latest-commit hosted CI must pass before merge. The develop
workflow skips Windows packaging and scale/release jobs; they are not
claimed as validated by this PR run.

## Compatibility and risks

Existing workflow permissions, conditions, script content and artifact
inputs are unchanged. Local act upload compatibility keeps its existing
v4 pin; the v9 script uses the supplied GitHub client and Node
built-ins, avoiding the removed CommonJS package import and
injected-name conflicts.

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: oxspan <[email protected]>

When a Collector runs in KST, declaring the same instants as a Los
Angeles storage day can return an empty successful stream. `doctor` and
`collector status` now expose the reported JVM time-zone ID and the
CLI-derived UTC offset at the Collector's clock time, with explicit
provenance. Online XLog search, capture, counter history and counter
export reject differing offsets with `INVALID_ARGUMENT` before streams
or capture writes; equivalent offsets remain accepted, including
historical/DST interval checks.

The ID comes from the existing authenticated `SERVER_ENV` response, and
the offset uses client JDK rules. Missing/unparseable metadata remains
unknown. This does not certify the Collector's runtime default, TZDB or
fixed-day storage calendar. Storage-date verification remains
unverified, and capture schemas remain unchanged. English and Korean
guides explain these limits.

Validation: the complete Gradle regression suite passes, line coverage
95.35% and branch coverage 81.11%; release-input checks pass. The 22 new
packaged CLI/zone-rule cases also pass on native Windows Java 21.
Regression tests fail against the previous CLI and with deliberately
broken fallback/DST handling. Actual Java 8 Collector 2.21.3 KST/LA/KST
queries change from 3/0/3 records to 3/error2/3; v3 profile capture
bytes match the previous CLI and remain readable by its strict reader.

Refs #57

Windows reports a child of a regular file as `NoSuchFileException`.
Capture and inspect therefore advised creating a missing directory even
though a file blocked the path. Validate the lexical parent before
reporting a missing path, so nested file ancestors receive the existing
not-a-directory guidance while genuinely missing directories retain
their existing message.

The correction adds one line and preserves error codes, integrity
checks, existing contents and genuine filesystem failures. No tests were
changed, weakened or skipped. The existing three CapturePathTest cases
fail before the change and pass afterward on native Windows, covering
both capture formats and resume paths.

Validation:
- Complete hosted Linux and Windows suites and native command package
verification pass for the exact head in [run
43251124659](https://github.com/oxspan/scouterctl/actions/runs/43251124659).
Required PR CI also passes.
- Line coverage 95.35% and branch coverage 81.08%, with unchanged
thresholds.
- Both ZIP checksums verify; Linux and Windows share byte-identical JVM
payloads. The downloaded Windows executable passes version, redirected
help, argument-error, invalid/missing-path and read-only grouped
inspection checks; capture bytes remain unchanged.

Release-readiness [run
43247008118](https://github.com/oxspan/scouterctl/actions/runs/43247008118)
exposed the original Windows failure. No master promotion, release
publication or version change is included.

Refs #75