Fix NilClass passed to Pub cooldown in_cooldown_period?

[v-kbukum1]

What are you trying to accomplish?

Fixes DELTAFORCE-1K1X.

Pub's cooldown filter could pass nil into in_cooldown_period?, which has a non-nilable signature.

• Root cause: the cooldown lookup compared a Pub::Version object against a version String, so it never matched and always fed nil into the check. A side effect is that Pub cooldown effectively never applied.
• Fix: compare on the string form so the matching release is found, and guard the no-release path.

Anything you want to highlight for special attention from reviewers?

The "can't apply cooldown" cases now have deliberately different semantics:

• No registry metadata at all → mark the shared "Cooldown was not applied" notice (PR + job warning), matching docker/common.
• Candidate diverges (dated releases exist, just not this resolver-proposed one) → skip cooldown for that candidate only, no global notice — the date source is healthy.
• Matched, dated release → normal cooldown evaluation.

Only Pub reproduces this; sibling ecosystems (uv/python) go through common's array-iterating filter_by_cooldown, which never passes nil.

How will you know you've accomplished your goal?

New specs cover the divergence, empty-metadata, and within-cooldown paths; the existing suite, RuboCop, and Sorbet runtime signature validation pass.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🟡 Changes recommended

Candidate-level warning state can leak into the ultimately selected update, and metadata completeness lacks direct coverage.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Defer cooldown marker until the selected candidate is known · New
• Add fetcher specs for metadata completeness state · New

Resolved since last review (2)

• Up-to-date dependencies incorrectly trigger cooldown warnings
• Partial metadata results incorrectly suppress unavailable-date notices

[Copilot]

Copilot review overview

🔵 Needs a closer look

Unavailable-date warnings can be emitted for candidates subsequently excluded by ignored-version rules.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Skip relevance warnings for versions matching ignored requirements
• Treat partial metadata fetches as incomplete before skipping cooldown

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation addresses the nil release path and its distinct fallback semantics with focused regression coverage.

Review effort: Balanced
Findings: None