v0.1.1

Patch release over v0.1.0.

Changes

• Attested releases — new attest-release.yml: every release (incl. a source
  archive) ships a SLSA build-provenance + CycloneDX SBOM attestation bound to an
  uploaded tarball, independently re-verifiable with gh attestation verify.
• catalog-updater engine — resolve the source repo from a git url (claude's
  canonical git-subdir/url schema), not only a repo field, with URL
  normalization (https / git@ / ssh, trailing slash, .git).

This release is itself attested (see the attested-delivery-0.1.1.tar.gz asset).