0.1.16

• security-bundle authenticates its exact called-workflow source fetch with
  the job token, so a shared fleet egress address cannot exhaust GitHub's
  anonymous allowance and stop the gate before any scanner runs.