v0.1.6

• Fix description wording: replace "trend signals" with "trend interpretation"
• Add SECURITY.md with vulnerability reporting policy
• Add GitHub Actions CI workflow for provenance-signed npm publishing
• Public source repo