Release v7.131.2

Fixed

• The secret-read, protected-write and store-mutation hooks read commands more conservatively: commands that name protected files run only in simple literal forms, shell-option changes that widen pattern matching are refused, and the refusal names the protected file and how to split the command. The hooks also require jq: without it they refuse the tool call and say why. Install jq where agents run, then run cratis ai update to install the updated hooks. The guards are a best-effort, defense-in-depth filter, not a sandbox; use OS-level sandboxing or file permissions for real protection.