v0.7.1

Changed

• Advance the audited Kimi Code compatibility baseline from 0.34.0 through
  0.36.1, covering the content-bearing plugin.session_start wire row,
  mixed-provider subagent sessions, additive task metadata, and the unchanged
  10-field status-line contract.
• Persist Git branch/dirty results across HUD command processes for 15 seconds,
  keyed by a cwd SHA-256 and capped at 64 worktrees. Concurrent cache misses
  merge under a bounded cross-process lock, cache files are forced to mode
  0600, optional Git locks are disabled, and the existing 150ms probe ceiling
  remains in place.

Fixed

• Fail closed when an all-agent Session Cost ledger contains nonzero usage from
  another provider or an unresolved model, avoiding partial session totals.
• Treat an unresolved model provider as unknown: no managed Kimi quota or
  provider usage is rendered or refreshed until attribution is explicit.

Security

• Resolve git through PATH to a canonical absolute executable and refuse
  workspace-local hits before running the dirty-tree probe.
• Strip OSC, CSI, other ESC string controls, and C0/DEL/C1 characters from all
  dynamic HUD text before adding HUD-owned ANSI styling.

Compatibility

• Audited against Kimi Code 0.36.1 at
  13d86f8b7bb2443a3b8222e7d94deb0a66429f8e.
• Full test suite: 347 tests passed.