v0.5.1 - right check, real citations

A correctness release for the corpus's claims about a third party, plus one
vector that had been living as a sentence.

Checkov claims: right check, real citations

The corpus makes three claims about Checkov's GitHub-OIDC checks. All three were
re-read against checkov 3.3.16 / d8aec9dba before this release, and all three
were wrong in some way:

• gh-aws-org-wide-wildcard-repo is an AWS vector and attributed its claim to
  CKV_AZURE_249 — the Azure check. The AWS checks are CKV_AWS_358 and
  CKV_AWS_393. Both fall through to the same gh_repo_regex and pass
  octo-org/* deliberately: the inline comments call it "a pass with a
  warning", though no warning mechanism exists.
• Two of the three claims carried no citation at all.
• The third pointed at a main blob path, which moves.

Each claim now carries a commit-pinned permalink with a line number — read out of
the pinned commit before it was written — and a version stamp.
az-fic-pull-request-danger also discloses that checkov#7627 proposes changing
the behaviour it describes, so the claim is explicitly version-scoped rather than
quietly perishable.

A measured claim with nothing to audit

The StringLike half of the case-sensitivity result existed only as a sentence
inside another vector's observation.evidence: measured on 2026-08-29, but with
no vector of its own and no transcript. That is the same shape that forced the
0.3.3 narrowing, so it is now gh-aws-stringlike-case-mismatch-rejected —
documented, cited, and in the harness default set, where one run will promote it
with a transcript like everything else. The observed vector's prose no longer
asserts the companion result on evidence this repository cannot show.

Corpus

github-aws suite 0.5.1, 40 vectors; 14 suites / 145 vectors overall.
Provenance unchanged at 11 observed.

Install

pip install subvectors==0.5.1

The wheel ships the entire corpus. The vectors are CC0; everything else is
Apache-2.0.