Tamra 0.1.1
Patch release. Hardens bundle verification (enforces the signed manifest window — closes a front-truncation false-VALID; bounds zip reading against a malicious bundle), adds a safety net to the async writer, and fixes CLI --help on subcommands. Libraries are on Maven Central; this jar is the CLI. Verify: SECURITY.md#verifying-a-release.