brain0 v0.1.1

The read set (what an agent read, the DLP side) was narrower than documented and declared-only by construction. This release widens what brain0 extracts from the transcripts, pins what it ingested, and says plainly what the read set is and is not. Addresses #1.

Sensitive reads: wider coverage

• Shell reads are now captured on both adapters: cat, head, tail, sed (not -i), grep/rg, awk, jq, diff, source/., < file, git show rev:path, across pipes, $(…), quoting, cd tracking and ~/$HOME. Heredoc bodies are skipped; unresolvable tokens ($VAR, globs, {}) are dropped, never guessed.
• Claude Code: Grep in content mode counts as a read of its target; the secret scan sees the full toolUseResult and results spilled to <sessionId>/tool-results/, not just the 2 KB inline preview; subagent transcripts (<sessionId>/subagents/*.jsonl) are discovered and merge into the parent session.
• Codex: reads were not captured at all. exec_command (string or argv form) is parsed, and the matching function_call_output (plain or {output, metadata} envelope) is scanned as the content the model saw.

Transcript pinning

Every ingest pass records the transcript byte range it consumed and its BLAKE3 digest in the append-only audit log. brain0 verify re-hashes those ranges and now reports transcripts: N ok, M changed, K missing/pruned, failing on a transcript rewritten or truncated after ingest. Pruned transcripts are counted, not failed.

Docs: what the read set is, and is not

docs/governance.md gains a section stating that the read set is single-source (the harness transcript, a log rather than the model's narrative) and a lower bound of what reached the model; what is and is not captured per adapter; that the remote flag is assumed, not observed; and what a fact-side source for reads would take (an inline proxy on the model API, kernel open events). README, docs/security.md and docs/agent-artifacts.md updated accordingly.

Paths and secret kinds only, never values, as before.

Full Changelog: v0.1.0...v0.1.1