weblogchecker 0.2.0

Baseline-diff orphan-executable detection: weblogchecker analyze suspect.log --baseline old.log reports executable paths that appear for the first time versus a trusted baseline log, scored on five stacked weak signals (answered 2xx/3xx, POST/PUT, referrer-less, at most 2 IPs, upload-style directory) with full evidence and the family delta vocabulary (NEW). First-seen alone is LOW; medium needs three signals, high four; confidence caps at medium; wp-admin-introduced paths are capped or dropped; baseline members are never flagged. FP gate extended: a normal busy WordPress baseline + later-log pair yields zero medium/high findings. Signed sdist + wheel + CycloneDX SBOM attached; verify with pgp-key.asc (fingerprint BAA1 586A AD37 18C0 CE41 D288 FE23 A624 54E3 5307).