v0.19.0

• Output-stream contract: a finite one-shot CLI routes result to stdout and error/progress/log to stderr; event-stream mode keeps all events on one ordered stream; the global --output-to <split|stdout|stderr> selects it
• CliEmitter finish/finish_result map a run outcome to an exit code (success to code, broken pipe to 0, other write error to 4) without the library ever calling process::exit
• Frontmatter mode: --input-format toml-frontmatter/yaml-frontmatter reads and edits dot-paths inside a Markdown page's +++/--- block with the usual document verbs, leaving the body byte-for-byte untouched (never auto-detected)
• Secret-safe config reads: DocumentFile::open_capped guards size and regular-file before reading, value_at reads a dot-path in one call, and DocumentError::redacted_message()/location() report a parse failure position without the source line
• DocumentError::code(), Format::name(), Value::kind_name() are now methods on the document types, replacing external match-on-enum helpers