v0.1.1

Documentation correctness fix.

v0.1.0's CLI examples and documentation named the flagship capability
bat.search. Dogfooding the published v0.1.0 binary showed the capability
the system actually produces is named bat.review — so every documented
command would have failed against a name that never exists.

• CLI examples now use the real capability name
• all documentation and examples corrected
• the flagship contract measurement is corrected to 432 bytes, observed
  from the release build

No behavioral change. 403 tests, race clean, vet and gofmt clean.

Verify your download

shasum -a 256 -c SHA256SUMS

v0.1.0

The first public release of GrokInstall.

GrokInstall answers one question honestly: when an agent is told to use a
capability, does it need installing at all? If the answer is no, it says so and
stops. If yes, it provisions, verifies and confines the runtime. If the safest
route requires authorization beyond the safe policy, it refuses, names the
specific blocker, and changes nothing.

What works today

• Detection and planning for supported strategies
• Safe, deterministic provisioning from GitHub release assets
• Refusal with a named blocker when the safe route needs extra authorization
• Per-capability isolation, post-install verification and tamper audit
• diagnose and audit
• A bounded GrokBot contract

What is only detected or planned

• Strategies not in the supported set are reported as detected, never as
  supported
• Knowledge import is implemented and bounded locally
• Context packs are generated and reported

Verify your download

shasum -a 256 -c SHA256SUMS

Flagship dogfood cases

• bat v0.26.1 provisioned from a GitHub release asset on darwin/arm64
• click correctly refused: the only safe route was a Python install whose
  build backend may execute packaging code

403 tests, race clean, vet and gofmt clean.