v0.2.9

What's Changed in v0.2.9

• fix(security): implement random nonce in AES-GCM and PBKDF2 key derivation (SEC-01, SEC-02, SEC-12)
• fix(ssh): prevent command injection via stdin streaming and fix permissions (SEC-04, SEC-05, B-01, B-05)
• fix(store): remove global config state, add HTTP timeouts, and fix Firebase embed (SEC-10, SEC-13)
• fix(sync): add safe type assertions on cloud pull and chain PreRun hooks (SEC-09, B-04, B-08)
• fix(cmd): add zip-slip protection, in-memory env parsing, and fix CLI command bugs (SEC-06, SEC-07, SEC-08, B-02, B-03, B-06, B-07)