CLI for OpenArch 0.4.2

Changes

• openarch mcp has a new flag, --allow-insecure. Without it, the init tool always keeps the secure defaults: it has no default-users, insecure-backends, bind-ip, expose, tls, cert, key or from parameter. Local models turned these options on when nobody asked for it.

The schema upgrade note of 0.4.0 still applies: run openarch migrate for a workspace made by 0.3.1 or older.

Changelog

• 843f62e Point the README at release 0.4.2
• 309e430 Let the MCP init tool turn security off only with --allow-insecure