v1.0.6

Tightens final enforcement behavior: required workflow/default dependency policy now uses floor mode, registry-qualified Docker Hub Node images are scanned, and malformed installed dependency manifests fail closed. Includes updated docs, regenerated bundles, and regression coverage.