v0.4.1

Security

• The readonly-bash hook approved any command placed after a # comment and a newline: the
  lines were joined with ; before tokenizing, so shlex's comment handling swallowed the rest
  and only the benign prefix was judged. Each line now loses its own comment first and a #
  inside a word stays part of the word, as in bash. Found by an independent review of 0.4.0.

Fixed

• A bare date MMDDhhmm operand, which sets the system clock, falls through to the prompt.
• harness uninstall removes the PATH line it added to ~/.zprofile and the ignore block it
  added to ~/.config/git/ignore, leaving every other line in place.

Changed

• CI runs harness sync --dry-run against the example config, as CONTRIBUTING said it did.
• The README points at --help for the full command surface and names config get;
  docs/preferences.md documents the vscode.manage and codex.manage keys.