## Summary

<!-- What does this PR do and why? -->

## Checklist

- [ ] The `assert_clean()` guarantee is not weakened or bypassed
- [ ] New functions have type hints and a one-line docstring
- [ ] Tests added or updated for any changed logic in `noteguard/`
- [ ] `make lint` and `make test` pass locally
- [ ] No credentials or API keys committed (check `.env` is git-ignored)
- [ ] `CHANGELOG.md` updated if this is a user-visible change