fix: 9 bug fixes — thread safety, error handling, mutable defaults

[verysleepylemon]

Summary

Nine targeted bug fixes across three core modules. No new features, no dependencies added.

notify.py — Thread-safe result counter

#	Fix	Impact
1	Replace non-thread-safe global \globvar\ with \ hreading.Lock-protected _results_count\	Eliminates race condition when queries run concurrently
2	Add \getResults()\ read-only accessor; fix off-by-one in \inish()\	Correct result count displayed at end of scan

sherlock.py — Error handling & CLI fixes

#	Fix	Impact
3	Normalise \errorType\ to list before membership check	Handles sites that declare multiple error detection methods
4	Remove .encode()\ on \
.text\ (already a decoded \str)	Prevents \�ytes-where-\str-expected downstream
5	Add \
is not None\ guard before WAF fingerprint scan	Prevents \AttributeError\ on timed-out requests
6	Change --print-found\ (\store_true, default=\True\ — a no-op) to --no-print-found\ (\store_false)	Users can now actually suppress found-site output
7	Use \lstrip('v').lstrip('release-')\ for version tag comparison	Handles tags like \
elease-0.16.0\ without false update prompts

sites.py — Mutable default arguments

#	Fix	Impact
8	Replace \username_unclaimed=secrets.token_urlsafe(10)\ with \None\ sentinel; honour caller value	Stops silently overwriting caller-supplied unclaimed usernames
9	Replace \do_not_exclude=[]\ with \None\ sentinel	Prevents shared mutable default state across calls

Testing

• All existing tests pass (\pytest\ on Python 3.10–3.13, Ubuntu/Windows/macOS)
• No new files, no new dependencies
• Diff: +31 −28 lines across 3 files