EverOS 1.0.1

Security

• Path-traversal hardening for caller-supplied identifiers. sender_id now carries the same path-safety guard as app_id / project_id: a character whitelist plus rejection of the . / .. tokens. The whitelist admits @ and + so email-style ids and plus-addressing still pass.
• Defense-in-depth write containment. MarkdownWriter now rejects any write target that resolves outside the configured memory root before reading, creating parent directories, or writing files. The API layer maps this backstop error to HTTP 400.

Documentation

• Add a multimodal usage guide and correct the multimodal error semantics after end-to-end verification.
• Document the upcoming Knowledge Wiki and idle/offline Reflection/Dreaming roadmap in the README and documentation set.
• Rename outdated algorithm-library references to everalgo across docs and code comments; no code identifiers changed.
• Fix accuracy drift found in a documentation audit; reflect the everalgo packages being published and the v1.0.0 stable status.