atelier v0.44.0

High-severity audit remediation release — 12 fixes from the 2026-07-15 audit (all 18 high findings now closed; the remaining 6 were fixed in sibling repos or previously resolved).

Fixes

• 19a34c8 fix(permissions): deny agent reads of atelier's gh identity tokens (#365)
• 59db4a3 fix(install): add ~/.local/bin to PATH after native Claude Code install (#364)
• fdf4e95 fix(install): export CLAUDE_CONFIG_DIR after preflight, not before (#363)
• 156ce57 fix(install): register gh credential helper in git-identity (#362)
• 4654381 fix(config): declare planStorage=resident (#357)
• afcb643 fix(update): permission-diff confirmation reachable without a TTY; new --yes flag (#356)
• c523896 fix(setup-project): accept --backend in atelier-setup-project arg parse (#355)
• fedf1b4 fix(abandon-task): route the tracking move via the orchestrator (#354)
• a68a8f2 fix(visual-validation): correct the unexecutable screenshot gist-upload recipe (#353)
• d45caa5 fix(pr-flow): pin the tracking commit as a required pre-push move (#352)
• adbb3a1 fix(decision-broker): read policy from decisionPolicy.byCategory (#351)
• 0048c0d fix(pr-author): run the size gate before the tracking move (#350)

Minor bump per PLAN.md §14.2: the set changes agent prompts, slash commands, hooks and the permission model, and adds backwards-compatible flags (atelier-update --yes, atelier-setup-project --backend).