v1.1.1

Maintenance release: no library code changes, no API changes.

Fixed

• CI: the SBOM freshness gate was unwinnable. It compared exact resolved versions against the committed sbom.json, but this is a library — composer.lock is intentionally not committed, so CI resolves fresh and any upstream patch release broke the build on commits that had changed nothing. The gate now compares the dependency set on release tags, still catching a dependency added or removed without regenerating the SBOM, while tolerating the patch drift the lockfile-less model guarantees. Other builds report drift as a notice; the uploaded artifact remains the authoritative record of what a build resolved.
• bin/generate-sbom.php identified itself as another package. Carried over when the script was copied from cboxdk/laravel-id, it emitted a laravel-id-sbom tool name and derived the BOM serial number from a cboxdk/laravel-id namespace. Both now derive from composer.json.
• Refreshed sbom.json. Identical package set, 21 version bumps, including guzzlehttp/guzzle 7.14.0 → 7.15.2 — the previous SBOM recorded a guzzle with six published advisories against it.
• Repaired two documentation paths left stale by the 1.0.2 docs restructure, and backfilled the CHANGELOG entries missing for 1.0.1 through 1.1.0.

Full changelog: https://github.com/cboxdk/laravel-risk/blob/v1.1.1/CHANGELOG.md