v0.4.0

可靠性修复：describe 打码更严、MCP --root 不会被链接绕过、读不出的金额不再按 0 汇总、rename 先写恢复记录再改名。
Reliability fixes: stricter masking in describe, MCP --root that links cannot get around, amounts that are not numbers no longer summed as 0, and rename that writes its undo log before renaming.

pip install --upgrade ofdkit

Fixed

• ofdkit rename --apply used to rename files first and write the --undo log last. Now the log is created before anything is renamed (if it cannot be, nothing is renamed), each rename is written to it and flushed to disk before it happens, and renaming stops if a line cannot be written. An OFD file and its PDF or XML copies are renamed together: if one fails, the others go back to their old names. --undo can be run more than once.
• Amounts that are not numbers were summed as 0 without a word. Such a value is now kept as found and noted in the invoice's warnings; sums add only plain decimal numbers (a real 0.00 still counts); the summary's new not_summed counts, for each amount, the invoices where it is missing or not a number. The command line, the Excel workbook and the MCP tool all use this rule.
• MCP --root: list_ofd_invoices could read OFD files behind links inside the allowed folder (a symbolic link to a file elsewhere, or a Windows directory junction in a recursive listing). Every file is now checked by its real location right before it is opened, links to folders outside are not entered, and listings report skipped_outside_root.
• ofdkit describe copied entry names, locations (FileLoc, DocRoot, BaseLoc ...) and ASCII attribute values as they were. Now only the OFD layout's own names are kept, other path parts are masked the same way wherever they appear so references can still be followed, other attribute values and runs of seven or more digits are masked. Masking is a best effort: check the output before sharing it.

Changed output: summaries gain not_summed, MCP listings gain skipped_outside_root, and describe output masks more.