fix(mcp): CORS-aware scaffold, cors.wildcard rule, server-not-appended FP; v1.1.2

CHANGELOG.md

@@ -6,6 +6,28 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.1.2] — 2026-08-08
+
+Patch. Fixes surfaced by an adversarial review plus the CORS wildcard trap.
+
+### Added
+
+- **`cors.wildcard-noop` rule** (`validate_snippet`). Flags `mw.CORS(...)` with a `"*"` literal —
+  which the framework now rejects at boot — and points to `CORSAllowAll()` or explicit origins.
+
+### Changed
+
+- **`get_scaffold`**: CORS is now env-gated (`CORSAllowAll` in local, `mw.CORS(origins)` elsewhere);
+  composes `launcher.Config` and `health.Config` so `EINHERJAR_COMPONENT_STOP_TIMEOUT` and
+  `EINHERJAR_HEALTH_CHECK_TIMEOUT` are reachable and appear in `.env.example`; the health hook uses
+  `health.NewHandlerWithConfig(...).ServeHTTP`; `.env.example` no longer emits `APP_CORS_ORIGINS=*`.
+- **`wire` builtin**: documents the CORS convention and recommends `check_env`'s `composes` selectors.
+
+### Fixed
+
+- **`web.server-not-appended`** no longer false-positives on a correctly-appended server; it fires
+  only when `server.New` is present and `.Append` is absent.
+
 ## [1.1.1] — 2026-08-07
 
 Patch. `check_env` gains struct-level granularity so it can catch dead vars that module