release: v1.0.1

Stability batch on top of v1.0.0 — three rounds of edge-case
hardening covered by 57 new tests (194 → 251). No new features; no
behavior change for users on the golden path.

Folds the accumulated [Unreleased] entries into ## [1.0.1] and drops
the empty Unreleased header so the publish.yml awk extractor lifts
the right block into the GitHub release notes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dmartinochoa

CHANGELOG.md

@@ -11,7 +11,18 @@ versions follow [SemVer](https://semver.org/).
 > section **above** Unreleased, or remove the Unreleased block for the
 > release commit. Otherwise the GitHub release ships boilerplate.
 
-## [Unreleased]
+## [1.0.1] — 2026-05-19
+
+Stability batch on top of v1.0.0 — three rounds of edge-case
+hardening covered by 57 new tests (194 → 251). No new features; no
+behavior change for users on the golden path. Highlights: the LSP
+install command now uses the universal `python -m pip` form so the
+official Windows Python installer + corporate ExecutionPolicy combo
+stops blocking first-run install; the welcome panel and status bar
+no longer go stale after an LSP crash or workspace-folder removal;
+`Scan workspace` against a dead LSP surfaces a real error instead of
+a false-success toast; the rc → ga "What's new" toast actually fires
+this time.
 
 ### Changed
 

package.json

@@ -2,7 +2,7 @@
   "name": "pipeline-check",
   "displayName": "Pipeline-Check",
   "description": "Lint CI/CD pipelines for 22 providers against OWASP Top 10 CI/CD Risks and 14 other compliance frameworks. 810+ rules, inline in your editor.",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "publisher": "greylag-ci",
   "license": "MIT",
   "icon": "icon.png",