Summary

Stability batch on top of v1.0.0 — three rounds of edge-case hardening (251 tests, was 194 at v1.0.0) plus the supply-chain hardening from #27 (CycloneDX SBOM + signed SLSA provenance attached to each release, publish-side npm audit gate). Folds the accumulated [Unreleased] entries into ## [1.0.1] so the publish.yml awk extractor lifts the right block into the GitHub release notes.

What ships

Editor / extension

• python -m pip install switch so the Windows ExecutionPolicy + official-installer-without-pip combo stops blocking first-run install
• Welcome panel no longer lies after an LSP crash — subscribes to client.onDidChangeState
• Scan Workspace against a dead LSP surfaces a real error instead of false-success
• Activation no longer hangs on a misconfigured serverArgs — client.start() raced against a 30s timeout
• disabledProviders silences lowercase dockerfile / jenkinsfile — case-insensitive glob match
• Medium batch (round 2): scan-workspace in-flight guard, install-terminal reuse, scan-on-save disabled-provider short-circuit, semver-aware rc → ga "What's new" toast
• Low batch (round 3): status-bar latch releases on workspace-folder removal
• Polish: extension.ts header comment migrated to python -m pip install to match every other surface

Supply chain (from #27)

• CycloneDX SBOM attached to each GitHub release
• Signed SLSA build provenance via OIDC + Sigstore keyless — verifiable with gh attestation verify <vsix> --owner greylag-ci
• npm audit --omit=dev --audit-level=high gate on the publish workflow

Cut sequence

After this PR merges to main:

git tag v1.0.1 && git push --tags

Publish workflow waits at production env gate; on approval, runs the new SBOM/provenance steps, publishes to VS Code Marketplace + Open VSX, and creates a GitHub release with the .vsix, the SBOM, and notes lifted from the ## [1.0.1] section.

Verification

• Rebased onto main (now includes b88b22f from ci: add SBOM, signed provenance, and publish-side npm audit #27)
• 251/251 vitest pass
• typecheck / lint / smoke clean
• awk '/^## \[/{n++} n==2{exit} n==1{print}' CHANGELOG.md dry-runs the release-notes extraction and produces the ## [1.0.1] block with the new Security section

🤖 Generated with Claude Code