v0.2.0

v0.2.0 — EVERY EXISTING PIN MUST BE RECOMPUTED

Tool digests have changed. A TrustPolicy pin computed against v0.1.0 will
refuse the tool it was created for.

That refusal is indistinguishable from a rug pull — a server swapping a tool
definition underneath you — and the usual response to a pin refusing a tool you
trust is to delete the pin. Deleting it turns a safe failure into no protection
at all. Recompute the pin instead, with php artisan prism-mcp:pins.

An empty map-typed field digested as [] where TypeScript and Python digested
{}. PHP has one array type, so the same field changed JSON type with its
contents — and a schemaless tool is not exotic, inputSchema is optional in the
MCP spec.

So an operator computing a pin against a running server got a different value
depending on which language they happened to compute it in, and nothing told
them. It fails closed, which is the safe direction, and it fails invisibly,
which is not.

Fixed by preserving container types at the DECODE boundary rather than repairing
them afterwards: Json::decode(..., preservingContainerTypes: true) keeps an
empty JSON object as an empty object, so nothing is inferred. Promoting every
empty array to an object — the obvious generalisation — would render the
entirely ordinary "required": [] as {}, trading one silent divergence for a
commoner one.

All 13 rows of the mcp-tool-digest conformance corpus are now byte-identical
in PHP, TypeScript and Python. Three of them disagreed before this release, and
no per-language test could ever have caught it: each implementation digests with
the same encoder it asserts against, so all three passed trivially and always
would have.

The corpus gained three rows that guard the FIX rather than the defect —
including an empty schema nested as a property, which no key-aware rule reaches.

• prism-mcp:pins computes and prints pins for a configured server.
• A -32601 on server/discover is read as a version signal rather than an
  error, so an older server degrades instead of failing.
• symfony/console is declared rather than relied on transitively.
• Ships an AGENTS.md, a prose check in CI, and a release workflow that refuses to
  publish unless the tests passed for that exact commit and Packagist actually
  serves the result.