v0.3.3

Adds a 38-second README demo generated from the real CLI with synthetic data, showing task initialization, deterministic stall detection, evidence verification, and privacy-safe handoff generation. The reviewed GIF is protected by an exact binary allowlist while all other public files remain covered by fail-closed UTF-8 and privacy scans.