0.1.8 - Static review before loading a Nerd

• Dropped bundles now show a local static review before load: declared purpose/configuration, file/function counts, Python imports and detected network/environment/file/process/dynamic-call patterns.
• Scan evidence includes file/line references. Full code review and explicit consent remain before running Python.
• No bundle code is imported or executed, no model is called, no destination is contacted and no environment value is read during review.
• Honest limits: detected names can be unrelated functions. Aliases, dynamic calls, dependencies and runtime behavior can evade this scan. No detected pattern does not mean absent or safe. This is not a safety verdict; bounded mode is NOT a security sandbox, and host files/network remain accessible.
• 431 source tests passed locally. Rebuilt wheel/sdist pass metadata checks and installation. Genuine ZIP drag/drop/review/consent/start/cited answer/stop/remove flow checked on desktop and phone, including reduced motion and current-app preservation. Static review pixels inspected on both screen sizes.