v0.4.0

Added

• harness trust <path> records a repository root whose ## Gate block the stop gate may
  run, and --remove forgets it; the list lives in ~/.config/agent-harness/trusted.txt.

Security

• The stop-gate hook runs a repository's ## Gate block only in a folder whose trust dialog
  has been accepted in Claude Code, or whose root is listed by the new harness trust <path>
  command, so a freshly cloned repository can no longer run commands on the first Stop. Until
  then it skips with a note on stderr.
• The session hook frames the handoff file it injects at session start as repository
  content on both sides, to be treated as data rather than instruction, the way the
  neutralize hook frames tool output.

Fixed

• The readonly-bash hook approved several commands that write or execute: a second command
  after a newline, awk scripts calling system() or redirecting output, env with a program
  argument, fd -x, rg --pre, sed -n scripts using w or e, sort -o, tree -o,
  yq -i, git grep --open-files-in-pager, a PATH= or GIT_*= prefix, any binary run by
  absolute path with a read-only name, and the >|, &>>, >& and <> redirections. Each now
  falls through to the permission prompt. tests/test_allow_readonly_bash.py pins the corpus.
• The settings template no longer carries the allow rules that granted the same primitives
  without the hook: Bash(awk *), Bash(sort *), Bash(sed -n *), Bash(fd *), Bash(rg *),
  Bash(tree *), Bash(file *), Bash(date *) and the leading-wildcard Bash(* --version).
  The hook approves the safe invocations of every one of them.

Changed

• harness sync removes an allow rule that an earlier template added and the current one has
  dropped, while still keeping rules the user added themselves.