v3.5.1

Added

• SLSA build provenance on every release for the source archive and the install script, attached as spillkit-vX.Y.Z.intoto.jsonl and verifiable with gh attestation verify spillkit-vX.Y.Z.tar.gz --repo aboutBilal/spillkit.

Fixed

• install.sh refused to install when cosign 2 was installed, because releases use the newer Sigstore bundle format. It now passes --new-bundle-format to cosign 2.4 and later, and says when cosign is too old.
• leak audit in CI (and the GitHub Action in audit mode) no longer reports "no pre-commit hook installed in this clone": a CI checkout never has one, so the finding was noise in code scanning. Developer clones are still checked.