EnvLatch v0.2.2

EnvLatch v0.2.2

EnvLatch v0.2.2 fixes a misleading agent-host result: a restricted process
could report saved_key_count=0 even though the user's keys remained available
through the normal macOS Keychain context.

Fixed

• envlatch doctor now labels saved_key_count as current-process visibility.
• A zero count in a known host sandbox emits
  keychain_visibility_warning=sandboxed_zero_is_inconclusive and exits
  nonzero instead of presenting the vault as conclusively empty.
• The bundled agent skill requires the complete envlatch run ... command to
  use the host's normal macOS Keychain approval path and forbids recreating
  keys based on a sandboxed zero.
• A genuinely empty vault outside a known sandbox remains a valid zero-key
  result.

No secret values are read by doctor, and this patch does not change the
Keychain service, saved values, endpoint metadata, key groups, or command
environment contract.

Signed macOS release

The arm64 DMG and ZIP are Developer ID signed, notarized by Apple, stapled, and
Gatekeeper-approved. Each artifact has an adjacent SHA-256 checksum.

• ZIP SHA-256:
  45568ece9cc45af67d94527485b258bc980d3d57251dcd9d25bb81c907853c87
• DMG SHA-256:
  49f0561e6f58aed1957aa7d096176e3f4a51503c302abec74797d811b63a6415