Adversarial-audit fixes to the installer only; the rule body is byte-identical to 0.5.1/0.5.2.
- Refuses symlinked destinations and paths resolving outside the project (a hostile checkout could otherwise redirect the write anywhere, even with --force).
- Malformed or duplicated managed markers abort with a clear message instead of false success, silent content loss, or a stale duplicate block.
- Every destructive dedicated-file update saves the replaced content to
<file>.bak(the signature test cannot tell an old Trial rule from a personal file quoting it). --update(undocumented --force alias) removed; unknown flags are rejected with usage.- Known limitation, documented: no version comparison — an older package re-run overwrites a newer rule (recover via .bak or VCS).
Full details in CHANGELOG.md. 24/24 tests; the five new guards were verified to fail against the 0.5.2 installer before the fix.