feat: pin library defaults for v2

[juan-fernandez]

What does this PR do?

Prepares v2 by replacing runtime latest resolution with reviewed default versions for every supported library:

• .NET: 3.49.0
• Java: 1.64.0
• JavaScript: 6.3.0
• Python: 4.11.0
• Python coverage: 7.15.1
• Ruby: 1.34.0
• Go/Orchestrion: v1.11.0

It also documents orb-version and per-library pinning trade-offs, adds the v1-to-v2 migration guide, and adds local helpers for batched library bumps and label-driven orb releases.

Motivation

Resolving the latest library versions during customer runs can change their environment without a new orb release. Pinned defaults make orb releases reproducible while preserving explicit per-library overrides.

This adapts the corresponding GitHub Action implementation from DataDog/test-visibility-github-action#70 to CircleCI registry-orb semantics.

Additional Notes

The current latest tag is v1.2.7. The semver-major label makes scripts/release-orb.sh select v2.0.0 after this PR is merged. The helper creates only an immutable vX.Y.Z tag; CircleCI resolves @2 through the orb registry, so no v2 Git branch is created or moved.

No orb version or Git tag is published by this PR. The pinned installation-script URL and checksum are unchanged, and transitive dependency pinning remains owned by the individual libraries.

Possible Drawbacks / Trade-offs

Customers moving from @1 to @2 may receive different libraries on their first v2 run. @2 receives reviewed compatible v2 releases and library bumps, while @2.0.0 remains fixed. An explicit library-version parameter stays authoritative across orb updates but must be updated manually for future library fixes.

Describe how to test/QA your changes

• Parsed the orb source, examples, CircleCI configs, and release workflow as YAML.
• Ran bash -n on all three new scripts.
• Verified README defaults exactly match src/commands/autoinstrument.yml.
• Exercised targeted and multi-library updates in isolated copies.
• Verified duplicate and invalid arguments fail.
• Ran the library bump PR creator against all official sources with --dry-run; all pins are current.
• Verified the PR creator refuses a live-source downgrade.
• Simulated a signed semver-major release after v1.2.7; it selected v2.0.0 without changing refs.
• Verified explicit --tag and --sha dry-run paths.
• Run the repository's CircleCI lint, pack, review, shellcheck, and command-test matrix on this PR.

[juan-fernandez]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e84c5e9e14

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-datadog-us1-prod]

More details

All adversarial scenarios passed clean. The seven library defaults in src/commands/autoinstrument.yml now supply non-empty DD_SET_TRACER_VERSION_* env vars to the install script instead of empty strings, which is the correct handoff the install script already expected. The three new maintenance scripts have valid semver comparison logic, correct YAML/README regex patterns, robust duplicate detection, and proper label-precedence ordering.

Was this helpful? React 👍 or 👎

_{📊 Validated against 14 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit 167fe35 · What is Autotest? · Any feedback? Reach out in #autotest}