cfctl v1.1.0

Unsigned release; integrity is by checksum. Verify against SHA256SUMS before use.

Changes

• plans cancel — new public verb. An approved plan is standing permission to mutate; until now its only exits were consumption or lazy 24-hour expiry. Cancellation retires that authority immediately, mirroring standing-authority revocation: monotonic (a cancelled plan can never be approved, run, or resumed), idempotent, effective even on drifted content, and journaled as the terminal Closed checkpoint so the transaction hash chain stays coherent (#83).
• Fresh governed state from ./cfctl — the repo wrapper now builds through the host cargo gate but runs the CLI outside it, so plan and authority status can never be served from a build result cache (#83).
• Pre-push policy is discoverable — documented in tracked CONTRIBUTING.md, and cargo xtask verify reports an unregistered or stale-pinned hook with the exact registration line (#82).
• Authority listings show their scope — zone_id and bound_resources are asserted output surface, closing the gap class that produced #80 (#82).
• Contract-debt posture stated — docs/v2-architecture.md names the ~84% blocked-mutation ratio as the gate holding, measured by catalog coverage (#83).

Plans stored by earlier versions are unaffected: cancelled_at is additive and outside the reviewed content hash.

Verification

cargo xtask verify exit 0 — fmt, clippy, full-workspace tests, cargo-deny, full-history secret scan. plans cancel live-proven: approve → cancel → run refused with retirement guidance; first production use retired a stale approved plan that lazy expiry had left live-looking on disk.