v1.0.1

First maintenance release. Closes guard bypasses surfaced by an adversarial audit (manual review + a codex second opinion); every fix ships a reproduction in the self-test.

Fixed

• Self-test now runs the wired settings command, not just the hook file — an exit-code-masked wiring (… || true) is caught as a hollow guard.
• secret_scan — cover ASIA… STS keys and access_key/private_key names; see through a type annotation (api_key: str = "…"); judge ${…} sanction on the literal residue so a real secret isn't shielded.
• status_guard — case-insensitive, whitespace-tolerant, frontmatter-scoped (closes the Status: / status : bypass and the prose false positive).
• gen_status — escape | in table cells.
• gen_dashboard — latest-audit considers only dated audit-YYYY-MM-DD.md files.

Full notes: CHANGELOG.md