fix(docs): stop Cloudflare rewriting version refs as email addresses

[paulosfjunior]

Two defects found while verifying the 1.1.0 release.

1. The published guide was mangling the most important line

Fetching the live page returned:

Quando alguém escreve <code>uses: Tooark/<a href="/cdn-cgi/l/email-protection"
class="__cf_email__" data-cfemail="6a090347190f...">[email&#160;protected]</a></code>

Cloudflare proxies tooark.com, and its Email Address Obfuscation rewrites anything shaped like an address. ci-security-scanner@v1.1.0 qualifies — the dots in the version make the right-hand side look like a domain. That is why restore@v4, checkout@v4 and actionlint@sha256 elsewhere on the page came through untouched: no dot, no match.

Two spans were affected — the prose explaining how to consume the Action, and a label in the flow diagram.

A visitor with JavaScript sees the decoded text, because Cloudflare injects a decoder. Without JS, before the decoder runs, or for anything reading the page as data, the line reads [email protected].

Fixed with Cloudflare's documented <!--email_off--> opt-out plus a note next to it, so the wrappers survive the next version bump. The markers are HTML comments, so the underlying text is unchanged and check-sync.sh section 4 still reads the pinned version out of the file — verified, section 4 still passes.

The alternative was switching Email Address Obfuscation off for the whole tooark.com zone, which is a much wider change for two spans on one page.

2. Both CHANGELOG compare links 404

releases/tag/v1.0.0   HTTP 404
releases/tag/v1.1.0   HTTP 200

v1.0.0 was never pushed as a tag — that content went into the initial commits and first reached consumers as 1.1.0. [1.1.0] pointed at compare/v1.0.0...v1.1.0 and [1.0.0] at a release that does not exist.

Now [1.1.0] points at its release and [1.0.0] at the commit that carried it, with a line in the 1.0.0 section saying it was never published as a tag so nobody goes hunting.

Affected area(s)

• docs/ — onboarding guide
• Governance / documentation only

Consumer impact

• No consumer-visible change

Checklist

• ./scripts/check-sync.sh passes, section 4 included
• python3 scripts/validate-templates.py passes
• HTML still balanced — 0 unclosed tags
• No version pins changed

Merging republishes the guide automatically; the Pages workflow triggers on docs/**.

🤖 Generated with Claude Code