0.1.0-alpha.3

Fixed

• The image vulnerability gate refused to tag the 0.1.0-alpha.2 image, so that
  release published its binaries and its crate but no pullable image tag. The
  finding was real: libssl3t64 in the distroless base, CVE-2026-14456, HIGH,
  with a Debian fix the base image has not been rebuilt against — the current
  :nonroot digest still carries the vulnerable version, so a base bump does not
  resolve it and a distroless image has no package manager to upgrade it in a
  layer of our own.

  It is adjudicated as unreachable rather than suppressed, on the shipped
  binary's own ELF header: its dynamic dependencies are libgcc_s, libm and
  libc only. TLS is rustls and the JOSE signing is aws-lc-rs, so nothing this
  project builds links OpenSSL, and the image is distroless — no shell, no
  package manager, no second executable that could load the library. The entry
  lives in a new .trivyignore.yaml, scoped to that one package by PURL, with
  the evidence and a three-month expiry, so it has to be re-argued rather than
  quietly becoming permanent.

Added

• scripts/checks/image-labels.sh, in the ungated guard tier. The base image
  digest is declared in three places — the runtime FROM, the Dockerfile's
  base.digest label, and the release pipeline's labels: input, which is the
  copy the published image actually carries because it overrides the Dockerfile's
  — and an automated base bump edits only the first. Without the guard, merging
  one publishes an image whose base.digest names a parent it was not built on.
  It also checks that every shared OCI key agrees between the two declaration
  sites, and refuses to pass vacuously if the publishing lane it expects is
  absent.
• ARCHITECTURE.md at the repository root: the instrument's design record,
  moved here from the FerroEHR mono-repo where it was written. It is the design
  authority for the machinery — the artifact set and the case-core field
  definitions, the operation bindings, the outcome taxonomy and the ambiguity
  register, the assertion vocabulary, verdict computation — and it carries the
  population-anchored performance-class model with its journey decomposition,
  plus the evidence base and the ISO/IEC 9646 and CASCO grounding the scheme is
  built in. Names and paths were adapted to this tree; the substance is
  unchanged.
• The GHCR image-pulls badge in the README, now that the package exists.
• A Dependabot ignore for rand major bumps. The dev-dependency exists to hand
  pgp's signing call an RNG, and pgp 0.20 is on rand_core 0.6, so a major
  bump does not compile. Patch and minor bumps within the pin are still proposed,
  and advisory-driven updates are unaffected.

Changed

• The container image states in its own header that its current payload is a
  placeholder: it ships the CLI today and becomes the web UI's image when that
  lands (#6). The CLI's own distribution channels are cargo install veredictum
  and the prebuilt binaries on each release.
• The distroless base moves to the current :nonroot digest
  (sha256:a77defd6…). This is not a security fix — the new digest carries
  the same libssl3t64 version, verified by scanning it — it is base currency,
  so the image is not built on a two-month-old parent.