Fixes
- restore the --version flag (the package refactor mangled it in v1.5.0)
- -J, --frida and --mermaid are now mutually exclusive instead of silently taking precedence
CI hardening
- actions pinned to commit SHAs; persist-credentials disabled
- Dependabot cooldowns before applying dependency updates
- zizmor and actionlint clean