v1.3.1

Security

• Enforce the vault boundary on resolved paths: a symlinked daily-notes folder
  or note file that resolves outside the (canonicalized) vault root is refused
  for reads and writes. Atomic note writes resolve the parent directory first
  and create the temp file with O_EXCL (create_new) under an unpredictable
  name, so a pre-created *.tmp-obsidian-daily-qs symlink can no longer
  redirect a write outside the vault.

Artifact: obsidian-daily-qs-1.3.1-linux-x86_64.tar.gz (statically linked musl x86_64).