v0.4.2 — Self-service onboarding + hardening

The self-service onboarding release

Three improvements shipped together — no new subsystems, just sharper edges.

ONBOARDING.md — new agents wire themselves up

Every vault now ships with a one-shot guide next to AGENTS.md. Onboarding a
new agent (Claude Code, Codex, Cursor, DSH, anything) is now a single sentence:

"Read AGENTS.md and follow it."

AGENTS.md routes first-timers to ONBOARDING.md, where they check which
access mode they are in:

• Have memory_* tools → MCP already wired, go work.
• Shell access → register the MCP server in their own client (name,
  command, env spelled out), restart, verify with memory_profile.
• File access only → read Index.md, grep Learnings/ — and explicitly
  told NOT to hand-write lesson files (ids/index consistency), secrets stay out.

Existing vaults get it via agentbrain init (idempotent) or by copying the
template file.

Secret redaction closes its last gaps

memory_ingest previously scanned only the lesson body and summary. A
credential smuggled into case_id (→ lands in the filename and frontmatter)
or tags (→ frontmatter) could slip past. All four inputs now go through the
same scanner. Placeholders (${ENV:VAR}, sk-xxx) remain exempt.

Hand-edited frontmatter can no longer poison the vault

A lesson file with confidence: high or use_count: many (typed by hand in
Obsidian) used to crash every vault read — queries, lint, doctor, everything.
Each numeric field now falls back to its default per-file; one bad file never
breaks the rest.

Verification

• 87 tests (3 new: credentials in case_id/tags refused; bad-numeric frontmatter
  tolerated with defaults; ONBOARDING.md present in scaffolding)
• Live vault regression: existing lessons unaffected, doctor healthy
• Wheel + sdist built, twine check PASSED, published on PyPI:
  https://pypi.org/project/mnemosyne-lite/0.4.2/

pip install --upgrade mnemosyne-lite