Content Guard 0.3.0

Added

• allow_values entries may now be longer than the matched span: a finding is also cleared when an allow value contains the matched text and the whole value is present on the matching line. This lets one known-public literal (for example a full public path) clear a broad-prefix match on that line only, instead of forcing an allowlist entry for the bare prefix that would exempt it everywhere.
• content-guard allow add / allow list subcommands for managing allow_values in the private policy from the command line, with optional provenance notes.
• jwt-token rule catching bare JSON Web Tokens anywhere in text.

Changed

• README now leads with a recorded terminal demo (docs/assets/content-guard-redact.svg, reproducible from content-guard-redact.cast) of the scan -> redact -> re-scan-clean flow, and adds CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, and issue / pull-request templates.
• README reworked for adoption: opening states what / why / how-it-differs, adds CI and PyPI version badges, a Website link, a verified real-output proof block, and “Why not gitleaks, trufflehog, or detect-secrets?” plus “What Content Guard is not” sections.

Fixed

• api-key-assignment no longer flags unquoted identifier RHS values such as apiKey = apiKeys.anthropicApiKey or token: daemonConfigPrimaryToken; unquoted values must now contain a digit and not be a dotted identifier chain. Identifier chain segments may contain digits (apiKeys.v2.anthropicApiKey, ctx.env.S3_SECRET_ACCESS_KEY), with JWT recall preserved by the new jwt-token rule. Quoted literals match as before.