- Adds a GitHub Actions release workflow that builds in CI and attaches a cryptographic build-provenance attestation to main.js, so it can be verified as actually built from this source.
- Adds a "Permissions & behavior" README section disclosing filesystem access, shell execution, and vault enumeration upfront.
- Removes the builtin-modules dev dependency (redundant with esbuild's platform: "node"; verified the bundle output is unchanged).
See CHANGELOG.md for details.