string-audit v0.3.1 — Vale gate + voice-safe em-dash tells

[bdelanghe]

What

Cuts v0.3.1, a patch release, by bumping version in package.json (and the README
Status line). The bump is the trigger: release.yml (#11) auto-tags v0.3.1 on the merge
commit and publishes a GitHub release with generated notes — no manual tag push.

This release exists so the downstream consumer site can move its vendored string-audit
pin off v0.3.0 (which predates the voice-safe tells) and onto a tag that includes them,
unblocking a later tighten of the gate to include warn.

Bundles what landed on main since v0.3.0

• ci: release workflow — tag + publish on version bump #11 — release workflow (tag + release on version bump)
• Gate Vale provider on AUDIT_VALE + voice-safe em-dash tells (closes #6) #12 — Vale provider gated on AUDIT_VALE; voice-safe em-dash tells (antithesis +
  cadence downgraded warn → suggestion, so intentional voice doesn't gate). Closes Adopt Vale's AI-tell rules instead of hand-maintaining the lexicon #6.
• store: lazy-load cas/anchored-chain (fix standalone offline run) #13 — store.mjs loads cas/anchored-chain only when STORE=cas.

Test

• node test.mjs green locally (contract + prose, incl. the voice-safe suggestion-level
  assertions for em-dash antithesis/cadence and the AUDIT_VALE-off gate).

PR run sheet

1. Independent PR — version bump + README Status line only; no code changes.
2. Changed codepaths verified — node test.mjs passes; no source touched.
3. Root cause identified — N/A (release cut, not a fix).
4. No duplication — N/A.
5. No unrelated changes — untracked RELEASE-v0.3.0.md deliberately left out.

🤖 Generated with Claude Code

[bdelanghe]

Superseded by #17. This branch bumped the pre-#15 package.json (version 0.3.0→0.3.1); #15 has since rewritten package.json entirely, so #17 restores the 0.3.x identity (incl. version 0.3.1) on top of current main.