v1.0.1 (2026-10-24)
- verify: now reads the effective INI values of every php/php-fpm binary (`-i`) and compares them with
  expose_php/display_errors/display_startup_errors=Off, log_errors=On. Exit 0 = all hardened, 1 = mismatch.
- plan/apply: detect later-loaded conf.d (and PHP_INI_SCAN_DIR) files that override the same keys;
  listed as "overrides", apply reports configuration_written_but_overridden.
- phpguard-watch.service: ProtectHome=read-only (was true) so web roots under /home can be monitored.
- audit: dpkg package list shows installed packages only.
- tests: 3 new unit tests (override detection, effective-value parsing, value normalisation).
v1.0.0 (2026-10-23) initial pilot release.
