Update quack-rs to v0.14.0, add in-process integration tests, bump to v0.7.0

[tomtom215]

Summary

Updates the SDK to the new quack-rs v0.14.0 release and hardens the testing and supply-chain story end to end. The extension's public surface (the 7 SQL functions) is unchanged — this is a dependency + testing + docs upgrade.

quack-rs 0.13.0 → 0.14.0

Every public API this crate uses (AggregateFunctionSetBuilder, FfiState, VectorReader/VectorWriter, ListVector, LogicalType::list, returns_logical, AggregateTestHarness, Connection/Registrar, entry_point_v2!) is unchanged — zero changes to existing source. v0.14.0 is purely additive: wasm32-unknown-emscripten (DuckDB-WASM) support, a bundled-test-prebuilt feature, and InMemoryDb::open_unsigned().

New: in-process extension-load integration tests (tests/extension_load.rs, 7 tests)

The headline improvement. They build the real release cdylib, append the DuckDB metadata footer (a Rust port of append_extension_metadata.py), and LOAD it into an in-memory DuckDB via quack-rs 0.14.0's testing::InMemoryDb::open_unsigned(), then exercise all seven functions through live SQL — inside cargo test, with no external duckdb CLI.

This closes the long-standing gap CLAUDE.md flags as the #1 testing risk: the segfault-on-load / silent-non-registration / wrong-result class of FFI bugs that unit tests cannot reach. Adds the quack-rs bundled-test dev-feature, which unifies with the existing duckdb/bundled dev-dependency (no extra DuckDB build) and never reaches the release .so.

Dependencies (cargo update)

• tar 0.4.45 → 0.4.46 — resolves GHSA-3pv8-6f4r-ffg2 ("PAX header desynchronization", moderate; a libduckdb-sys build-dependency). This is the open Dependabot alert on main.
• cc 1.2.61 → 1.2.63, shlex 1.3.0 → 2.0.1, arrow 58.1 → 58.3, plus routine transitive bumps.
• All direct deps are at their latest versions; the only held-back transitive crate is comfy-table (constrained by the duckdb dev-dependency). All bumped crates declare MSRV ≤ 1.85, so the project MSRV stays 1.87.
• deny.toml: tightly-scoped CC0-1.0 exception for tiny-keccak — a phantom Cargo.lock entry behind ahash's optional, never-enabled compile-time-rng feature (absent from every buildable graph and from the shipped .so), so modern cargo-deny releases pass the license gate.

Version + docs

Bumps the extension to v0.7.0 (the project convention: each quack-rs upgrade gets a version bump) and updates every version reference across README.md, CLAUDE.md, SECURITY.md, description.yml, scripts/setup.sh, docs/src/**, the issue/PR templates, and the community-submission workflow + CHANGELOG.md. The description.yml ref is intentionally left for the release step.

Verification (run locally, directly)

Gate	Result
cargo test	453 unit + 7 integration + 1 doc-test — all pass
cargo nextest run --profile ci	460 pass (CI's exact process-per-test path)
cargo clippy --all-targets -- -D warnings	0 warnings
cargo fmt -- --check	clean
cargo doc --no-deps --document-private-items (-Dwarnings)	clean
cargo deny check advisories bans licenses sources	all ok
cargo bench --no-run	7/7 benches compile
MSRV 1.87	safe — every bumped crate declares MSRV ≤ 1.85

The mature core algorithm modules are intentionally left untouched — they're exhaustively (mutation-guided) tested already; changing them would be churn, not improvement.

https://claude.ai/code/session_01XrxjxwWKPZWTspc1UBQScN

---

Generated by Claude Code