v1.1.0 - TB003 webhook enforcement

Adds TB003 Unsigned Known Provider Webhook enforcement.

V1 active automated blockers are now exactly:

• TB001 Client-Side Secret Exposure
• TB002 Destructive Public RLS / DB Rules
• TB003 Unsigned Known Provider Webhook

TB003 blocks confirmed critical unsigned webhook routes for supported known providers: Stripe, Clerk, Shopify, and GitHub.

Verified:

• Local tests, typecheck, and build passed.
• External red test blocked unsigned Stripe webhook with TB003.
• External green test passed signed Stripe webhook.
• Immutable v1.1.0 tag passed.
• Floating v1 tag passed.

TrustBoundary v1.0.1

Patch release for TrustBoundary V1 GitHub Action.

Changes:

• Removes GitHub Action dependency cache path that failed in external repositories.
• Keeps the composite action install-build-run release path.
• Verified external usage with Arjunisking/trustboundary@v1.
• Confirmed blocking behavior for Confirmed Critical webhook-and-agent-abuse finding.
• Confirmed pass behavior after visible webhook signature verification.

V1 remains focused on deterministic scanning only. It does not claim that an app is secure.