v0.1.0

First release: local capture proxy with lazy lifecycle, consent-gated routing, verbatim capture with streaming reassembly, local redaction, spooling with a bounded quota, acknowledged idempotent batch uploads, enable/disable/logout/uninstall lifecycle, status and doctor (including quarantine requeue and diagnostic bundles), and the release pipeline.

Hardened ahead of the tag:

• The proxy port's holder is trusted only after it answers an admin-token challenge, with one token published per listen address. Management calls that act on the port wait out a sibling still starting up instead of blaming it, and each rides a connection of its own, so a takeover never leaves a dead pooled connection behind.
• Only a strictly older release is asked to drain and hand the port over, and the flush a proxy runs on its way out is bounded so the port is released inside its successor's wait; whatever that flush did not upload stays spooled and uploads later under the same batch id.
• Upload attempts get a time budget sized to the batch, unreadable records are set aside instead of stalling every upload, and trajector doctor discard deletes a quarantined batch for good — the terminal counterpart to trajector doctor requeue.
• trajector status says why recording stopped — a full or otherwise unwritable spool — in the same words doctor uses, and the dashboard stays whole when a store cannot be read.
• State files are replaced and read atomically on every platform, Windows rename collisions included.

Verify a download against trajector_checksums.txt and the build provenance attestation as described in the README.