rcp 0.1.1

Changed

• The project lives at https://github.com/rust-cp/rcp; documentation is at
  https://rust-cp.github.io/rcp/.
• Container package lists name packages without versions, so a superseded
  distribution package no longer breaks the build. The base images stay digest pinned.

Fixed

• The release binary now starts on RHEL 9 and other GNU libc 2.34 systems. v0.1.0's
  binary was built on Ubuntu 24.04 and required glibc 2.39. Releases are now built in a
  digest-pinned Debian Bullseye builder, the build fails if the binary needs a GNU libc
  newer than 2.34, and the binary is run on UBI 9 before it is published.
• On Linux ARM64, protected opens use that architecture's O_NOFOLLOW and O_DIRECTORY
  values, so they refuse symbolic links as they do on x86-64.
• rcp version no longer claims "no runtime dependencies". On Windows it lists the
  transports that build supports.

Added

• A release archive carries SBOM.spdx.json, and the GitHub release publishes
  that SPDX document next to the archive and checksums.
• Releases are signed: each archive gets a keyless Sigstore bundle
  (*.tar.gz.sigstore.json), and the release carries SLSA build provenance
  (rcp.intoto.jsonl, rcp.sigstore.json).
• Releases publish the hardened container image to ghcr.io/rust-cp/rcp, signed with
  cosign, with an SPDX SBOM attestation and build provenance on the image digest.
• Windows x86-64 (MSVC): local NTFS paths, with private-file ACLs and directory
  durability, and the s3://, smb://, dav:// and https:// endpoints. Build from
  source; there is no Windows release asset yet, and SMB has not been tested against a
  real Windows server.
• Linux ARM64: ordinary operations tested on native ARM64 hardware. Build from source;
  NFS, Kerberos and OCI have not been run natively on ARM64.
• A hardened container image definition under container/, built in CI with an SBOM and
  a vulnerability gate.
• Registry publishing records the build target, commit, rustc version and source
  repository in the manifest annotations.