v1.0.1 — Windows --since fix

Patch release.

• Fixes audit --since <ref> on Windows, where git rejected the base lockfile path as "outside repository" when its rev-parse --show-toplevel (long name) disagreed with os.tmpdir()'s 8.3 short name (e.g. runneradmin vs RUNNER~1). The base lockfile is now resolved via git show <ref>:./<file> from the lockfile's directory — no host-side path math. Adds a monorepo/subdirectory regression test.

No other changes; see v1.0.0 for the feature release. 129 tests, CI green on ubuntu/windows × node 20/22.