v0.1.1 — operational hardening

First cut with a real release surface: tag + Release object + artifacts together.

Operational hardening (no API or behavior changes)

• CI honesty bundle: bwrap installed for sandbox tests, honest Go 1.26 matrix, grouped sqlite3 guard (OB-GAP-087/088/090), AppArmor unprivileged-userns restriction lifted (OB-GAP-091)
• Deploy: off-by-one systemd unit vendored in-repo with doc pointers and a drift guard (OB-GAP-089)
• Docs: gitreins guard recipe corrected in README/CONTRIBUTING (the deleted gitreins-poc venv path replaced by the pipx shim)
• Hygiene: churning classes untracked (.gitreins/logs/, board .pre- snapshots) so git status stays clean

Artifacts

• off-by-one-v0.1.1-linux-amd64 / -arm64 — static (CGO_ENABLED=0), version-stamped via ldflags; SHA256SUMS included. --version prints off-by-one v0.1.1.
• SQLite graph store is pure Go (modernc.org/sqlite) — no libc dependency.

Install: download the binary for your arch, chmod +x, run ./off-by-one-v0.1.1-linux-amd64 --port 8766. See README Quick Start for off-by-one seed and Muster integration.

Range: v0.1.0..v0.1.1 (26 commits, all chore/docs/deploy/data — zero feat/fix).