v1.0.1

Security

• Hardened headless-build tar extraction: the compatibility fallback (Python
  < 3.11.4, e.g. Debian 12) now validates each member's resolved path is within
  the destination and extracts it individually. The modern-Python data filter
  path is unchanged.

Added

• GitHub Releases are now created automatically on version tags, with notes from
  this changelog and the built sdist/wheel attached.
• Security policy (SECURITY.md), Dependabot version updates, and CodeQL code
  scanning.