1.0.3

An advisory WAF match no longer masks custom enforcement (TIGER-82).

inspect() returned on the first shipped match. A soft category is capped at log, waf.action itself defaults to log, and custom admin rules were only evaluated when nothing shipped had matched at all. So a request matching both a shipped heuristic and an administrator's custom block rule was allowed — the observe-only verdict shadowed the policy that said block.

An advisory rule may inform, never mask. Everything is now evaluated and the strongest action wins (log < captcha < block), short-circuiting only on a block. Learn/off mode and the outage fail-open are unchanged.

Also adds a test suite and CI — this module shipped with neither, and its enforcement logic just changed. 7 tests running on PHP 8.1 and 8.4, including controls in the opposite direction: an advisory match alone stays advisory, and a log-only custom rule cannot soften a shipped block.