purexml 1.0.0 — the public contract freeze

A pure-Python, zero-dependency drop-in for `defusedxml`. Hardens the standard-library XML parsers against entity-expansion bombs, external-entity resolution (XXE), and external-DTD retrieval — returning the same standard `xml.etree` / `minidom` / SAX objects. Migrate with a literal `s/defusedxml/purexml/`.

1.0 is the contract freeze: the defusedxml-mirror surface is now stable to 2.0 (see PUBLIC_CONTRACT.md), ratified with the anchor consumer (file-observer). No parse-or-block behavior change. The opt-in defense-in-depth (Limits, security_report()) stays provisional by design.

Runs on CPython 3.10–3.13. MIT licensed. See CHANGELOG.md for full notes.