v0.1.2

Fixed

• MFA, privilege, enabled and active flags (mfaRegistered, isPrivileged, accountEnabled,
  mfaEnrolled, isAdmin, active) must be JSON booleans or null; a string such as
  "false" was treated as true. Other types now raise a clear error (exit 2).
• Every identifier field the rules read (email, mail, userPrincipalName, login,
  name, username) is type- and control-character-checked in every export, so a record such
  as {"mail": "a@x.com", "email": 42} exits 2 instead of crashing. Display names skip
  non-string values.
• Okta status must be a string or null (with the control-character check); other types exit 2.
  A null or missing Okta status or Entra accountEnabled is treated as unknown: it no longer
  fires a false ID002 or drops the account from ID003. A null Crowd active also stays in
  ID003 (ID003 covers Entra, Okta and Crowd only).
• Any UnicodeError while decoding an export (not only UnicodeDecodeError) exits 2.