v0.1.1

First release through the hardened path: protected signed annotated tag, prepared artifact, npm trusted publishing. 0.1.0 was published manually after its release workflow failed and has no provenance.

No behavioural change. The 2026-07-29 remediation pass over docs/securityscan.md re-checked all seven findings and disputed every one — each suggested remediation traded a theoretical problem for a real one.

• Documents why the principal-revocation guard lease is deliberately never consulted: expiry judged from an issuing host's clock would let a host running fast release a guard taken seconds ago and issue a session inside the revocation window. Recovery from a faulted revocation stays a repeat destroyAllForPrincipal, which compares no clocks.
• Adds a race case pinning that an issuer whose clock sits a full lease ahead of the revoker is still refused while a revocation is in flight.
• Records the dispositions in docs/securityscan.md and reformats that file so npm run format:check passes.