fix: CLI polish, placeholder hardening, and v1 launch surface reducti…

…on (#10)

## Summary
- CLI UX polish: standardized cancel messages, improved init/uninstall
flows, better error messages
- Placeholder engine hardening: tightened provider matchers, added
value-shape gating, closed false-positive paths in SendGrid/Supabase
- Launch surface reduction: cut AWS SigV4, GitHub App JWT, HTTP Basic
auth, MCP config scanning, URL-with-password DSN handling, mismatch
detector
- Test coverage: SIGTERM escalation, streaming response regression, env
scanner, signal forwarding, walker tests
- Docs reconciliation: aligned README/MVP/ARCHITECTURE with v1 surface

## Test plan
- [ ] `go test ./...` passes
- [ ] `go vet ./...` clean
- [ ] Spot-check `veil init`, `veil run`, `veil log` CLI flows

🤖 Generated with [Claude Code](https://claude.com/claude-code)

chore(release): v0.1.1 — security hardening

Symlink-safe filesystem operations, proxy/credential handling hardening,
scanner and placeholder fixes, process/env hygiene, CLI validation, audit
log sanitization, and CI/release pinning. See CHANGELOG.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(release): pin goreleaser to workflow ref via GORELEASER_CURRENT_TAG

When two tags point at the same commit (e.g. v0.1.0-rc1 and v0.1.0
both at 40d7ffd), goreleaser's tag picker resolved to v0.1.0-rc1 even
though the workflow had checked out refs/tags/v0.1.0. Result: the
v0.1.0 release workflow built artifacts named veil_0.1.0-rc1_* and
tried to upload them to the existing rc1 release, failing with 422
already_exists for every asset.

GORELEASER_CURRENT_TAG is honored by goreleaser as the authoritative
current tag, bypassing the heuristic entirely. Setting it to
github.ref_name guarantees CI builds whatever tag actually triggered
the workflow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs(changelog): set v0.1.0 release date

Replace the YYYY-MM-DD placeholder with today's actual launch date
(2026-05-13) and drop the now-stale meta-note about the date being
filled in at tag time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>