v0.6.3

Valhuntir 0.6.3 is a bug-fix release; wintools-mcp changes only its version. For Claude Code on the SIFT workstation, a hook now checks Bash commands and blocks common ways of deleting or overwriting case records, audit logs and evidence files; other files can still be moved to a case's DELETE/ folder, and new evidence files can be added. Ingest now reports truncated event logs and the real error of a failed event log, the case summary flags a failed artifact whose index holds partial data, and a failed profile run is no longer hidden by a later successful one. During ingest on SIFT, EZ tools receive evidence paths containing spaces intact, and Amcache and registry output with embedded NUL bytes is indexed on Python 3.10. Fuzzy host matching no longer merges hosts whose names differ in digits or contain a dot, and domain threat-intel verdicts are stamped only on keyword fields. Valhuntir's gateway, backends and ingest workers start Python in isolated mode (-I). The installer refuses a --venv directory that isn't a virtual environment instead of deleting it; uninstall no longer deletes the folder above the install directory, or the gateway configuration you chose to keep; and the client setup scripts back up the workspace MCP and settings files and merge Claude Desktop's config instead of replacing it. To upgrade, run vhir update (a second time if Claude Code isn't your client), restart the gateway if you used --no-restart, run vhir setup client once, and review host aliases that earlier versions saved in each case's host-dictionary.yaml. Full changes: v0.6.2...v0.6.3