v1.0.2 — the 100% coverage release

The maintainership directive superseding 1.0.1's print-only coverage posture, worked through the wayfinder decisions (#20-#22): line coverage of lib/ now gates CI at 100% — every runtime-reachable line covered, 31 provably-dead defensive arms deleted with proofs rather than exempted, and the ignore list carrying only what :cover structurally cannot observe (Spark's generated DSL sections, test-support, four compile-window module-body lines).

Added

• Injectable :cacerts trust bundle on both HTTP adapters (Target.ssl_options/2; worker http_opts — compile-time literals or {m, f, a} resolved per-perform) for private-CA endpoints. Default unchanged (OTP CA store).
• TLS success paths covered by real CA-verified loopback sessions against committed local fixtures, including the literal-IP iPAddress-SAN floor.

Fixed

• CertSan.ip_san_match?/2 fails closed (returns false) instead of crashing its caller on garbage SAN bytes — asn1 decode failures exit on OTP 29 and raise on 27/28; the bare catch covers every class (cross-vendor reviewed).
• The alternate :httpc adapter refuses literal-IP HTTPS fail-closed (:ip_literal_https_needs_bounded): it cannot run the IP-SAN floor, and chain validation alone would let any chain-valid cert authenticate the endpoint IP. Use the default adapter there.
• use AshHooks.Worker no longer silently drops :http_opts.

Send failures now classify through the read path — the Erlang inet/ssl drivers queue sends and surface peer-death errors on the next operation (probed on both platform families, both transports); the unreachable {:send_failed, _} wrap is gone with the probe evidence in the commit messages.