v0.1.2 — verifiable builds, safer credential file

Security-focused release. Worth updating to.

Every binary here is now verifiable. Releases are built by a public workflow that records signed build provenance. The .exe is still unsigned — a certificate costs $99/year and this stays free — but you no longer have to take that on faith:

gh attestation verify InboxSweeper.exe --repo elixir-bash/inboxsweeper

Fixed: a window where your app password was readable. On Linux and any non-macOS system without a Keychain, credentials fall back to ~/.config/mail-declutter/. That file was written first and locked down to 0600 immediately after — but in between it sat on disk under the default umask, world-readable on most systems. It's now created 0600, inside a 0700 directory. macOS was never affected (it uses the Keychain).

Hardened the build itself. Actions are pinned to commit SHAs rather than mutable tags, and the workflow runs with the minimum permissions it needs. A compromise upstream of this project shouldn't be able to reach a binary you download from it.

Also: the local web UI validates the mail provider at the request boundary instead of relying on a downstream error; there's now a security policy with a private reporting channel; LICENSE is verbatim MIT again (an appended note was making it register as "Other").

Nothing changed about how sweeping works, and nothing about the privacy model: your mail and credentials still never leave your machine.