release: v0.19.0

[raccioly]

Cuts the release that has been sitting on main since v0.18.0 — 90 lines of [Unreleased] across
seven sections, including a feature and four false-positive fixes.

Why 0.19.0 and not 0.18.1

websec init --claimspec PATH|- is new public CLI surface, and the README's release section
states the rule: "In the 0.x series, feature additions or incompatible contracts increment the
minor version."

Stating the counter-evidence honestly: this rule has been broken before — 0.15.3, a patch,
shipped two entirely new commands (websec demo, websec explain). That reads as a lapse rather
than a policy, so this follows the written rule.

Contents

PR	What
#157	feat(claimspec) — the ignore kind writer
#155	fix(detectors) — the substance of #142 and #143, with controls
#154	fix(detectors) — #128 and #143 with the controls they were missing
—	the calibration table's prose contradicted its own counts
#153, #156, #158	technical brief + Pages; spec 002 public evidence; three README corrections

Migration: none required, but the note calls out the one thing a CI author should expect —
fewer findings. Four false-positive sources are fixed, so a --fail-on gate or baseline diff
that tripped on a timing-unsafe-compare against a length, a weak-password-hash over an
identifier, an extension handler whose sender check sat behind an alias, or a PII projection that
actually removed the field now comes back clean. Each fix ships with the paired true-positive
control, so it is a precision gain, not a coverage loss.

One test assertion changed — please read this bit

tests/test_explained_brief.py counted every ## [x.y] heading in the changelog and compared
it to a literal 28 — the running total. The brief is a snapshot of STATED_VERSION and says so on
its own last page ("asserted by the test suite against the source tree at the version in the
masthead"), so that pin failed on every release while proving nothing extra: a brief cannot
overstate a release that shipped after it was written. Its sibling pins were already relaxed for
exactly this reason (test count is a floor; the masthead only has to be a shipped version), so
this looks like an oversight rather than policy.

It now counts releases at-or-before STATED_VERSION. The equality and the prose assertion both
remain, so a brief that overstates what existed at its own version still fails:

brief stamped	asserted count
0.17.0	26
0.18.0	28 ← current
0.19.0	29

The original loose regex is kept as the counting basis — a stricter three-component regex silently
drops the grouped ## [0.2.x] heading and yields 27. Logged as bug-339.

Per AGENTS.md this rewrites an existing assertion, so it wants a human read. Happy to revert it and
instead do a full brief refresh if you'd rather keep the strict pin.

Deliberately not done

The brief still reads v0.18.0. Bumping its masthead means re-stating the release count, moving
the cadence figure's last point and regenerating the PDF — a design pass on a published artifact,
not release mechanics. Worth its own PR.

Verification

• python3 -m unittest discover -s tests → 1579 tests OK (skipped=2)
• docguard guard → exit 2, unchanged from baseline; docguard specs --check clean
• python .github/scripts/release.py tag-version → version=0.19.0 should_tag=true

⚠️ Merge with squash so the commit subject stays release: v0.19.0. release-tag.yml matches
the head commit subject; a merge commit would retitle it and the train would silently skip, as it
did for v0.17.0.

🤖 Generated with Claude Code