align with metadata standard

Cargo.lock

@@ -1075,7 +1075,8 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "meta-feeder-sdk"
-version = "0.1.0"
+version = "1.3.0"
+source = "git+https://github.com/worph/meta-feeder-sdk?tag=v1.2.2#1c9d415a1e554d0604e2b465666d64192adde752"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1090,7 +1091,6 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "tempfile",
  "thiserror 1.0.69",
  "tokio",
  "tracing",
@@ -2397,6 +2397,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "axum",
+ "base64",
  "bytes",
  "chrono",
  "flate2",

README.md

@@ -120,9 +120,9 @@ cargo clippy --workspace --all-targets -- -D warnings
 docker build -f feeder-plugin/usenet-feeder/Dockerfile -t ghcr.io/worph/meta-feeder-usenet:dev .
 ```
 
-`meta-feeder-sdk` is a git dependency pinned by tag (`v1.3.0`; this repo used to
-vendor a copy). Until that tag is pushed, cargo cannot resolve it — not even
-under a `[patch]` override. To verify against a local SDK checkout, build a
+`meta-feeder-sdk` is a git dependency pinned by tag (`v1.2.2`; this repo used to
+vendor a copy). An SDK change is invisible here until it is tagged and pushed,
+and cargo cannot resolve an unpushed tag — not even under a `[patch]` override. To verify against a local SDK checkout, build a
 scratch copy with the dependency swapped for a path (never commit that form —
 this repo is the Docker build context):
 

feeder-plugin/usenet-feeder/Cargo.toml

@@ -32,7 +32,7 @@ path = "src/main.rs"
 [dependencies]
 # Pinned by TAG, never by path. A path dep resolves OUTSIDE this repo, and this
 # repo is the Docker build context. (Until 1.3.0 this repo vendored a copy.)
-meta-feeder-sdk = { git = "https://github.com/worph/meta-feeder-sdk", tag = "v1.3.0" }
+meta-feeder-sdk = { git = "https://github.com/worph/meta-feeder-sdk", tag = "v1.2.2" }
 
 tokio = { version = "1.40", features = ["full"] }
 axum = { version = "0.7", features = ["json"] }