EnvLatch v0.2.0 — signed & notarized for macOS

EnvLatch v0.2.0

EnvLatch v0.2.0 adds two multi-key workflows while keeping the same
provider-agnostic launch contract.

New

• Repeat --using with exact saved key names for a one-off multi-key command.
• Run envlatch groups create to save a reusable group from non-secret key
  names.
• Installed agent guidance and the GUI setup prompt teach both paths.

Safety behavior

• The complete repeated selection and every endpoint binding are validated
  before any Keychain value is read.
• Repeated selectors reject duplicates and accept saved keys only; an existing
  group must be used by itself.
• Group creation never reads values, refuses missing keys and endpoint
  conflicts, and never replaces an existing group.
• Pairing remains setup status, not authorization.

Signed macOS release

The recommended arm64 DMG and ZIP are Developer ID signed, notarized by Apple,
stapled, and accepted by Gatekeeper. Each has an adjacent SHA-256 checksum.
The explicitly named unsigned DMG remains a legacy preview.

Users upgrading from an ad-hoc-signed build may receive one Keychain
authorization prompt per existing item. Enter the login password and choose
Always Allow once; choosing Allow authorizes only the current read.
Touch ID-per-read is intentionally not the default because it would block
unattended agent launches.