v0.3.1

Added

• Release engineering: scripts/verify.mjs (versions, syntax, packed contents, required files,
  documentation links) and scripts/version.mjs (bump every package.json plus
  CODEX_PLUGIN_VERSION in one step).
• .github/workflows/release.yml: tag v* → verify → test → npm publish --provenance for both
  packages → GitHub release notes taken from this file.
• Community files: CODE_OF_CONDUCT.md, issue forms, PR template, Dependabot, .editorconfig,
  .gitattributes, .nvmrc.
• Docs: docs/FAQ.md and docs/PUBLISHING.md; "Where to find it" tables in both READMEs.
• Tests for the Codex marketplace output and for config portability/migration (34 tests total).

Changed

• defaultConfig() now writes memory.dshBudgetBytes: "auto" and portablePaths() normalises path
  separators, so one hub.json round-trips unchanged on every platform.
• migrateLegacyHub(legacyRoot, hubRoot) takes explicit roots, which is what makes the migration
  path testable; the CLI call site is unchanged.
• Marketplace and plugin display names are Agentloom (they still said Agent Hub).

Fixed

• scripts/verify.mjs no longer triggers Node's DEP0190 deprecation warning when invoking
  npm pack on Windows.
• LICENSE is shipped inside both published packages instead of only at the repository root.
• Link handling on macOS: isLink() compared realpath() with the lexical path, so every real
  directory under /var/... (which resolves to /private/var/...) looked like a link. The probe is
  now lstat()-first everywhere and the realpath fallback is Windows-only; ownership, pruning and
  linkStatus() compare paths through new samePath() / isUnder() helpers.