v1.0.1

Retries the pkgtruth fetch when a release has not replicated yet.

Publishing pkgtruth 0.2.0 showed a window of about three minutes in which the registry listed the version but its tarball returned 404, so workflows on @latest failed with E404. The scan step now retries fetch errors up to four times, thirty seconds apart, before reporting a failure. Verdict failures are unaffected.

Also inherits pkgtruth 0.2.0: scan now covers requirements*.txt and pyproject.toml alongside package.json, so Python dependencies in the same repository are gated too.