fix: sync package.json version with published tags, backfill changelog

[dmchaledev]

Summary

Closes #94. package.json/package-lock.json on main were still at 1.0.1 while npm has already shipped v1.0.2 and v1.0.3 — because publish.yml only bumped the version inside its own ephemeral job (npm version "$TAG_VERSION" --no-git-tag-version) and never committed that bump back to main. CHANGELOG.md was similarly stuck at 1.0.1 despite grade-changing rule fixes shipping in between (stricter Permissions-Policy scoring, CSP base-uri/bare-scheme checks, etc.), with no record of why a CI gate's result might have changed.

• Bump package.json/package-lock.json to 1.0.3 (the latest published tag) so security-headers --version reports the truth.
• Backfill CHANGELOG.md with [1.0.2] and [1.0.3] entries, called out by PR/issue number, including the grading-relevant changes.
• Fix the root cause in .github/workflows/auto-tag.yml: it now runs npm version itself and commits the release (chore: release vX.Y.Z [skip ci]) alongside the tag it pushes, so main and the published version can no longer drift apart. [skip ci] keeps the release commit from re-triggering CI (and therefore this same workflow).

No source/behavior changes to the library itself — only package.json, package-lock.json, CHANGELOG.md, and the auto-tag workflow.

Test plan

• npm run typecheck passes
• npm test passes (85/85)
• Verified package.json and package-lock.json versions match (1.0.3) and are valid JSON
• Validated .github/workflows/auto-tag.yml YAML syntax
• Next green CI run on main will exercise the updated auto-tag workflow end-to-end (commit + tag + push)

🤖 Generated with Claude Code

https://claude.ai/code/session_01GmYTtFbpbcmFtYv7RbJRFL

---

Generated by Claude Code

[dmchaledev]

Found a real bug in combining this with #98 (now merged): #98's publish.yml checks out github.event.workflow_run.head_sha when triggered by "Auto Tag" completing — that SHA is fixed to the commit that triggered that workflow run, i.e. the pre-release commit, not the release commit this PR's auto-tag.yml change creates afterward. Tagging after committing the version bump would move the tag onto a commit publish.yml never sees, so it'd resolve no matching tag and silently (re-)publish a stale, already-published version every cycle — reintroducing a variant of the exact bug #98 fixed.

Pushed a fix reordering auto-tag.yml to tag HEAD first (matching what publish.yml checks out), then commit the package.json/package-lock.json bump on top for the next cycle's baseline. Also merged current main in to pick up #98/#108. Verified locally: npm run typecheck, npm test (85/85), npm run build all pass. Merging now that this composes correctly with #98.

---

Generated by Claude Code