Release v1.1.8

fix: attest release artifacts with build provenance

Obsidian's plugin scan flagged that the released main.js cannot be
independently reproduced from source. Add GitHub build-provenance
attestation (Sigstore-signed) so the released main.js/manifest.json/
styles.css can be cryptographically verified as genuine CI output from
this commit, regardless of byte-level build reproducibility:

    gh attestation verify main.js --repo iOSonntag/obsidian-plugin-treefocus

- add id-token:write + attestations:write permissions
- attest-build-provenance pinned by commit SHA, gated to real releases

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Release v1.1.7

fix: stop staging trivy cache in release workflow

The v1.1.6 release run created the GitHub release fine but failed on the
final push: `git add .` swept Trivy's multi-GB vuln DB (./.cache) into the
commit, exceeding GitHub's 100 MB file limit, so the version-bump commit
never reached master.

- release.yml: `git add .` -> `git add -u` (stage tracked files only)
- .gitignore: ignore ./.cache so the scanner DB can't be committed

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Release v1.1.6

fix: refresh pnpm lockfile to v9.0 and modernize toolchain

The Obsidian community plugin scan flagged the pnpm lockfile as out of
date. The committed lockfile was lockfileVersion 6.1 (pnpm 8), which a
modern pnpm rejects (ERR_PNPM_LOCKFILE_BREAKING_CHANGE) - the plugin was
removed from the community list on 2026-05-12.

Regenerate the lockfile to 9.0 and modernize the toolchain so it stays
valid:

- pnpm 11 (packageManager) + lockfile regenerated to 9.0
- update all dependencies to latest (esbuild 0.28, typescript 6,
  husky 9, semantic-release 25, commitlint 21, @types/node 22)
- pin obsidian (^1.13.0) instead of floating "latest"
- tsconfig: bundler resolution + src/* paths (replaces deprecated
  baseUrl), explicit types: [node]
- pnpm-workspace.yaml allowBuilds for esbuild (pnpm 11 build-script gate)
- husky 9 hook format
- CI: Node 22, pnpm 11, all actions pinned by commit SHA, Trivy
  supply-chain gate (fails on HIGH/CRITICAL vulns or leaked secrets),
  frozen-lockfile install, least-privilege permissions
- remove dead eslint config

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Release v1.1.5

Merge pull request #7 from iOSonntag/copilot/fix-folder-focus-disappe…

Release v1.1.4

fix: disable EVENT and INFO logging

Release v1.1.3

fix: disable debug logging

Release v1.1.2

fix(mobile): moved debug logging to desktop only

Release v1.1.1

fix(readme): fixed readme

Release v1.1.0

feat(better functionallity): remove artifacts, keep renamed files & more

Release v1.0.8

fix(ci): missing tag