fix(deps): require ZIPFoundation by version so consumers can resolve OpenTDFKit

[arkavo-com]

Problem

Since 4.0.2, Package.swift pins ZIPFoundation to a revision (e7a17d5). SwiftPM won't resolve a package that is required by a stable version when that package depends on a revision, so no consumer that requires OpenTDFKit by version can resolve 4.0.2 or 5.0.0:

'opentdfkit' >= 5.0.0 cannot be used because package 'opentdfkit' is required using a stable-version
but 'opentdfkit' depends on an unstable-version package 'zipfoundation'

That is why ArkavoKit, ArkavoMediaKit, Creator and arkavo-ios all still resolve 4.0.1.

Change

• Require ZIPFoundation from: "0.9.20", its latest release. Package.resolved now records 0.9.20 (22787ff).
• The revision pin only avoided 0.9.20's watchOS deployment-target warning (#388). No OpenTDFKit code needs anything newer than 0.9.20.

Verification

• swift build --build-tests passes.
• swift test: 288 tests, 11 skipped, 1 failure.
  • The failure is StreamingBenchmarkTests.testMemoryUsageWith2MBChunk, a peak-memory bound measured in a local debug run (about 214 MB against a 70 MB limit).
  • It fails the same way on unmodified 5.0.0 with the revision pin, so this change doesn't cause it.

Once this merges, tag 5.0.1 so consumers can move to the 5.x line.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TTtgscNah3Wk739yom9NPF

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Replacing ZIPFoundation’s pinned revision with release 0.9.20 changes the resolved archive dependency and could alter ZIP processing behavior for consumers.

Changes the ZIPFoundation dependency in Package.swift from a revision pin to from: "0.9.20" so stable-version consumers like OpenTDFKit 5.0.0 can resolve. No open findings; review approved.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

Review coverage

🤖 Auto-approval Approved

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)