v0.11.0

Bug Fixes

• docker: Restore container access after the DAC cap drop, shield the task dir
  (#106,
  56bffad)

• reference: Address code review and CodeQL findings
  (#106,
  56bffad)

• reference: Address PR review — scoring correctness, fail-closed anti-cheat
  (#106,
  56bffad)

• reference: Clear remaining CodeQL alerts
  (#106,
  56bffad)

Documentation

• reference: Record why READ_ONLY_MODE exists, and what is left to wire
  (#106,
  56bffad)

Features

• reference: Directory-only references + anti-cheat permission window
  (#106,
  56bffad)

Testing

• early-stop: CE036 enforces the live_verdict determinism + monotonicity contract
  (#126,
  d854004)

• reference: Skip host-side chmod assertions on Windows
  (#106,
  56bffad)