0.4.0

• agd init in a terminal asks which packs to install, unless --with names them. It lists each pack with its file count, the packs it needs and its agents and skills; you type numbers or names, or press Enter for every pack. With fzf installed, you pick them in fzf (Esc installs nothing). Packs come with the packs they require, and agd says which it added. Without a terminal, or with --yes, agd installs every pack as before, so scripts are unchanged.
• agd notices when a source moves a release's tag. .agd.lock records the commit behind each installed release in a new commit <source> <sha> line, and status, update, add, remove, diff, merge and reset stop when the tag points elsewhere, printing both commits and the change to the installed files. agd update --to <version> accepts the release as it is now. A lock without the line gets it the next time agd writes the lock, without a warning. It stays agd-lock 1: older agd reads it, and drops the line when it rewrites the lock.
• agd update --to works in a project with several sources: --to <source>@<version> (or @<commit>) moves that source and leaves the others as they are. A bare --to <version> there still stops, and says how to name the source. Tab completion offers <source>@<version> when there are several sources.
• agd check [<folder>] checks a source before you release it, so a mistake shows up there rather than in a project's install. It reads the working tree with the parsing installs use, and reports a path that doesn't exist, a folder without its /, a file in two packs, a requires that names no pack, a requires cycle, a path with spaces or quotes, a missing release tag and a min-agd newer than agd, one line each, with the line of packs.txt. It exits with 1 on an error. Lines it doesn't know, packs without files and, under a kit folder, files in no pack are warnings. It writes nothing and fetches nothing.
• Each release's agd, agd-<version>.tar.gz and SHA256SUMS have a build provenance attestation, so gh attestation verify agd --repo Zejnilovic/agd shows that this repository's Release workflow built the file you downloaded. The workflow checks it on Linux, macOS and Windows; install.sh is unchanged.
• agd uninstall takes agd out of a project in one step: it removes every source, deletes the installed files you haven't changed and .agd.lock, and leaves .agd-ignore and the cache. It lists what it will do first, asks about each file you changed (delete it, or keep it as yours) and asks once more before writing anything. Without a terminal it needs --yes, which keeps every changed file.