v1.1.0

Fixes a real bug in the Slack reporter and closes a couple of security/CI gaps found during a hardening pass. No breaking changes.

Fixed

• --output slack could silently drop the webhook post. It fired on an unstructured Task and returned immediately, so with --exit-code set the process would call exit(1) before the task ever got scheduled. analyze now awaits the Slack post before returning.
• ClaudeClassifier swallowed JSON encoding failures and sent an empty request body instead of raising an error, which showed up as a confusing 400 from the Claude API. It now throws a clear parseError if the request can't be encoded.
• The CLI's --version flag was still printing 0.1.0, left over from before the v1.0.0 tag. Now prints 1.1.0.

Added

• SwiftLint in CI (.swiftlint.yml tuned to the existing code style, force_unwrapping opted in since this tool parses untrusted xcodebuild/xcresult output and Claude API responses).
• CodeQL analysis workflow for Swift.
• dependency-review-action gated on pull requests.
• First test coverage for ClaudeClassifier: well-formed responses, markdown-fenced JSON, non-200 status codes, and malformed response bodies, using a stubbed URLProtocol instead of hitting the real API.

Docs

• Removed a README link to docs/architecture.drawio, which was never actually checked into the repo.

17 tests before this release, 22 after. swift build -c release and swift test both pass clean.