v1.0.3

[1.0.3] - 2026-08-15

Production audit: installer integrity, Windows device path confinement, and
fail-loud fixture loading.

• The standalone installer verifies the GitHub release-asset SHA-256 digest
  (digest on the Releases API) after download and before extract. A missing
  digest is a hard failure. The GitHub API request uses TLS 1.2 and a
  battest-installer User-Agent.
• Fixture script, setup, teardown, copy, equals_file, and
  files[].path values cannot be rooted, cannot contain .., and cannot name
  reserved Windows devices (nul, con, aux, clock$, and the rest).
  JSON Schema patterns match those runtime rules.
• Unreadable scripts fail at load time instead of skipping tilde warnings.
  Wrapper-relative script names must be ASCII so cmd.exe cannot mis-decode
  the UTF-8 wrapper.
• Destructive-internal absolute-path warnings also match C:/..., quoted
  targets, and /flag forms such as del /f /q C:\Windows\Temp\x.txt.
• The uninstaller kill helper is kept in parity with
  scripts/installer_ps/Stop-BattestInstalledProcess.ps1.
• Stub CLI tests fsync the copied helper and retry ETXTBSY on exec as well
  as copy, so cargo llvm-cov on Linux overlayfs does not fail with
  "Text file busy".
• CI and Action docs continue to pin GitHub Actions to version tags,
  not commit SHAs.