src2sink 1.0.1

No functional changes. The analyser, its output schema, and the CLI are
byte-for-byte what 1.0.0 shipped. There is nothing here a user of 1.0.0 needs;
the version exists to carry the release automation and documentation below.

Added

• This changelog, and a release procedure (docs/releasing.md)
  covering versioning, the gate run, tagging, building, and recovery when a bad
  version reaches PyPI.
• Automated publishing via PyPI Trusted Publishing (OIDC). A v* tag now
  builds from the tagged tree, verifies the tag matches the packaged version,
  publishes to PyPI, and attaches the same artefacts to the GitHub release —
  with no API token stored anywhere in the repository.
• A link to this changelog from the README.

Fixed

• CI cache save race. Every cached job derived the same uv cache key and
  started at once, so they raced for the save reservation and the losers
  annotated each run with "Unable to reserve cache". One job now writes the
  cache and the rest restore only; srtm, which installs nothing, opts out
  entirely (the input defaults to auto, which had quietly opted it in).
  Verified on a green run with zero annotations.