v3.4.0

A full-codebase audit fix batch.

Fixed

• Auto-compact death spiral — _estimate_tokens used the cumulative lifetime input-token sum, so after enough turns auto-compact fired on every message, repeatedly nuking the conversation. Now uses the most recent request's prompt size and resets after compaction.
• Command injection in git_diff — the auto-approved tool interpolated args into a shell=True string (RCE via prompt injection). Now runs git diff via argv with shlex, no shell.
• /team crashed with NameError — re was used but never imported at module level.
• Unbounded agentic loops — max_iterations was defined but never enforced; now capped (default 15, configurable).
• API keys world-readable — ~/.kodiqa/settings.json now written with 0600 perms (dir 0700).

Changed

• Non-blocking startup — the model update/discovery check (which ran ollama pull on every installed model + scraped ollama.com every launch) is throttled to once per update_check_interval_hours (default 24) and skippable via --no-update / check_updates: false.

Added

• --no-update CLI flag; check_updates / update_check_interval_hours config options.
• ruff linting + CI lint step; dead-code/unused-import cleanup.
• Regression tests for the git_diff-injection and auto-compact fixes (290 tests total).