v0.19.0

Added

• PUBLIC_API.md — declares the package's semver-protected surface
  ahead of the eventual 1.0 freeze. The stable surface is the AutoSync
  composer-hook façade (run / runWithSummary), the
  bin/package-boost-php CLI contract (the gitattributes / lean
  command names, their --check / --working-dir options, and the
  0 ok / 1 failure exit codes), and the # >>> package-boost (managed) >>>
  managed-block marker format. Everything else is @internal.

Changed

• Surface markers added in source: @api on AutoSync; @internal
  on ManagedBlockWriter and the two CLI command classes. These document
  intent — the CLI invocation and the marker format are the contract, not
  the PHP classes. No behavior change.

Non-breaking — documentation and PHPDoc annotations only. Prepares the
package to tag 1.0.0 in lockstep with boost-core's 1.0 freeze (at which
point the surface above locks for the 1.x line).

Full Changelog: 0.18.1...0.19.0