v1.4.0

A minor rather than a patch release: export --redact-living withholds more than it
did, validate gains two warnings and reports years it previously read as unknown, and
compare scores dates differently. Files that exported or validated cleanly under 1.3.0
will look different.

If you use --redact-living, read this first

Three ways a living person could reach a published export are closed. The one most
likely to have affected you: only structured fields were blanked, so a note on a
deceased relative's record republished a living person verbatim — one row reading
"given_name": "Living" while another carried "Her daughter Carol Roe was born 3 March
1992 at 14 Acacia Avenue". Notes are where genealogy software keeps exactly that prose.
notes is now withheld from every row when the flag is set, not only redacted ones.

Also closed: RESN on a FAM record was ignored, so a family your software marked
confidential was published in full; and a non-Gregorian date decided liveness on its raw
year, so a French Republican date in 2021 read as an age of ~1796.

The cost is over-redaction. Unknown now means living, a free-text date is reported but
never acted on, and genuine notes about the dead are dropped. On the 3,010-person
royal92.ged reference file redaction goes from 357 individuals to 1,227.

Dates you will now see reported

• W035 names a date the parser could not read (30 November 1989, 12/2/1882) and
  — new in this release — dates it reads wrong: Reg 1823 becomes a month "REG",
  3/1990 becomes a dual year. royal92.ged carries four: two it cannot read
  (10 JAN, 20 JUL — no year) and two it read wrongly (1056/1060,
  ABT 1103/1105 — ranges written as dual dates), which only this release names.
• W036 names a burial dated before the death it follows, or before the birth.
• birth_year/death_year are recovered from dates ged4py cannot parse, so export
  and stats report years where they previously reported null.
• A dual date now reads its Gregorian year: 1 MAR 1665/6 is 1666, not 1665.
• W020 no longer reports a negative age for a parent born after their own child;
  E012 already covers that case. On royal92.ged this removes four warnings.

Security

export, filter and convert now verify that the file they opened is the file they
inspected. A FIFO planted at the output path during the parse phase previously received
the whole export while the run reported success. A failure to tighten permissions to
0600 on overwrite is an error rather than silently ignored.

A classic Mac (CR-only) GEDCOM leaked its HEAD block — often carrying the exporter's
local path and username — into validation reports, which have no --redact-living and
are routinely pasted into bug trackers.

Compatibility

Python 3.11+. No new required dependencies beyond convertdate, which ged4py already
pulled in. No CLI flags changed. 1.4.0 is a minor because output changed for input
1.3.0 already accepted.

Full detail, including the reasoning behind each trade-off, is in
CHANGELOG.md.