v0.2.0 - Scoped Recipient Rings, Anonymous memfd Injection & Cache Verification

What's Changed in v0.2.0

Scoped Recipient Rings (--ring)

• Introduced independent access boundaries (e.g. --ring prod, --ring dev) with dedicated master keys, recipient sets, and .gitattributes filter bindings (filter=agecrypt-prod).
• Allows locking, unlocking, enrolling, and rekeying rings completely independently within a single repository.

Anonymous In-Memory Secret Passing (git-agecrypt run --fd)

• Added support for passing decrypted secrets via Linux kernel anonymous RAM descriptors (SYS_memfd_create), bypassing /proc/<pid>/environ inspection.

Cryptographic Cache Authentication

• Hardened HMAC-SHA256 ciphertext caching with authenticated in-RAM decryption before cache hits are accepted, with automatic eviction on corruption and complete cache purge on rekey.

Fail-Closed Durability

• Propagated I/O errors strictly across all filesystem operations, lock journals, and merge targets to prevent silent partial writes.

Full Changelog: v0.1.4...v0.2.0