## What & why

<!-- What does this change, and why? Link any related issue, e.g. Closes #123. -->

## Checklist

- [ ] Commits use [Conventional Commit](https://www.conventionalcommits.org/) prefixes (release-please versions and builds the changelog from them)
- [ ] Tests added/updated and `pytest` passes; coverage stays ≥ 80%
- [ ] Fail-closed preserved — no new path where an error results in "allow"
- [ ] Docs/README updated if behavior or the public API changed
