v0.1.1

Security scan remediation (2026-07-29). Patch release; no exported signature or type changed.

• begin now bounds the provider-supplied event type instead of storing it verbatim (F-03). It is truncated to 256 characters — never mid-surrogate-pair — and a non-string value is recorded as null, each logged as a warn. Bounding rather than rejecting is deliberate: a throw from begin would leave no receipt at all, so attempts could never increment and quarantine could never engage. The warn runs after the insert, so a host logger that throws cannot stop the receipt from existing.
• Dev-dependency advisories cleared (F-01). Root overrides raise brace-expansion, uuid, and @opentelemetry/core to patched floors in the Azurite dev tree, taking npm audit from 12 vulnerabilities (5 high, 7 moderate) to 0. No production dependency changed.
• Supply-chain detection added (F-02). Dependabot for npm and GitHub Actions, plus a production-scoped npm audit --omit=dev gate in CI.
• Two Informational findings were reviewed and disputed as non-findings; reasoning is recorded in docs/securityscan.md.