v0.31.0

• Format negative fiat amounts in all four languages instead of falling through to the raw value, and refuse an out-of-range integer literal that would otherwise round into a plausible but wrong amount.
• Add redact_urls_in_text in all four languages to scrub complete scheme-prefixed URL spans inside prose, under one explicitly enumerated span grammar so the four agree byte for byte.
• Add an exact url_names list so a legacy URL field receives _url treatment, recursing into collections to reach every string leaf.
• BREAKING: replace BoundCliSpec::execute with dispatch bound at resolution — resolve_from returns a BoundOutcome whose run branch carries its handler, so running cannot fail and no caller writes an unreachable error arm.
• BREAKING: restore ResolvedInvocation::required to an infallible read, and add call_every_combination so a handler reading an argument id its combination does not declare fails from a test instead of silently receiving a default.
• BREAKING: OutputPlan::Protocol carries typed OutputFormat and OutputTo values instead of strings.
• BREAKING: name CLI failures by category instead of quoting the offending token, and tell a caller who put a command after its arguments what to fix.
• Add CliSpec::shared_arg for an argument every command accepts, declared once instead of repeated on every command where the copies can drift.
• Add ArgSpec::uuid() and ArgSpec::range() so UUID and bounded-integer arguments are rejected as usage errors at exit 2 rather than re-validated inside handlers at exit 1.
• Add cli_invocation_invalid_event and stream_redirect::install_from_plan so consumers stop hand-rolling the same error event and the same redirect installation.
• Add source-preserving TOML collection editing for arrays, array elements, inline tables and ordinary tables, never inventing a comment or moving one onto a value the author did not write it for.
• Add DocumentFile::open_capped, create_atomic, typed decode, and edit_and_validate, with hardened Unix opens behind the new default-on libc feature.
• Report an over-cap read as document_too_large so a size budget need not be told apart from a missing or unreadable file by matching on a message.
• Add ErrorSpec and ErrorCatalog for declaring stable public domain errors separately from runtime diagnostics.
• Move the afdata lint rule engine into the library as lint_value with assertion helpers, and align its suffix matching with the redactor so a mixed-case field is reported rather than certified clean.
• Find a redaction canary even after JSON, YAML, logfmt or percent escaping, so a secret that survived into output can no longer pass the assertion.
• Redesign the tracing layer into a composable AfdataLayer with an injectable writer and a StructuredLogHandle for nested JSON, writing each line in one call so a shared stream cannot interleave.