v0.19.0

Consent gets harder to give by accident, and the toolbox gets a word for a
name. Two changes here are breaking for scripts; both are listed first.

• BREAKING: trust --yes now requires --consented <surface_digest>,
  wherever it is typed. A bare --yes acknowledged a review nobody had read.
  The digest binds the acknowledgement to the exact bytes that were previewed,
  so a script consents to a surface it has actually seen or it does not consent
  at all. Get the digest from agentstack trust --preview, whose
  surface_digest field already carries its sha256: prefix.

• BREAKING: a scripted init --yes no longer trusts the project. It
  acknowledges the WRITE — the import — and never the servers the import
  declares, so a headless import now leaves the project untrusted and consent
  is its own step. At a terminal nothing changes: plain agentstack init still
  asks the question inside the wizard. Scripts that relied on the old
  behaviour need an explicit trust step; the first-value demo shows the
  two-command headless form.

• The guard refuses the one verb that could consent on an agent's behalf.
  An agent shell can no longer run agentstack trust/yes in any spelling —
  through a path, a wrapper, a pipeline, a quoted sh -c, or either spelling of
  the display-only namespace. The read-only half of those verbs, --preview
  and --list included, still runs: refusing a review nobody can act on would
  only hide the surface. The trust store is also closed to interpreters and
  file tools, so consent cannot be forged by writing the file directly.

• agentstack x is now agentstack more. The toolbox prefix has a word for
  a name, and every page that taught x teaches more. x keeps working —
  it is a permanent alias, not a deprecation, so nothing scripted breaks and
  both spellings parse forever.

• up is a visible verb. The fresh-machine command is on the default help
  screen rather than one hop behind the namespace, and start.md has a section
  for the second machine.

• Your editor now autocompletes the manifest. A JSON Schema is generated
  from the same serde model that parses agentstack.toml, so the two cannot
  drift: every field, its type and its doc comment reach the editor, and a
  typo'd key is underlined rather than silently ignored. init writes a
  #:schema line at the top of a generated manifest, and the schema is
  published with the docs, so taplo / Even Better TOML, Zed and IntelliJ pick
  it up with no configuration. A CI gate regenerates the schema and fails on
  any drift from the published file.

• Materializing a skill is roughly 20x faster on macOS. Copying a skill tree
  is one clonefile(2) call on APFS — the kernel shares extents copy-on-write
  instead of reading and writing every byte. Taken only when the tree is
  eligible; anything the syscall cannot reproduce faithfully falls back to the
  ordinary recursive copy, so the tree that lands is the same either way.

Egress proxy image: ghcr.io/tarekkharsa/agentstack-egress-proxy@sha256:e1eead9df77425ef82c345a6de9b169156671e88f2841581931b3c2e84e63a63