v0.34.0

• Move the atomic file installation — private same-directory temporary file, fsync, atomic install, parent-directory fsync — into one shared sequence, so skill install gains the parent fsync it was missing and no longer reports success while the new directory entry can still be lost to a power cut; a failure that leaves the file installed but its durability unconfirmed now says so
• Refuse to reach a skill file or a bundled asset through a symlinked directory below the skills root on install, uninstall and status, closing the path where a linked skills subdirectory redirects a fixed-name write and lets uninstall delete wherever it pointed; --force no longer offers itself as the remedy, because it permits replacing an unmanaged file inside the root, not writing outside it
• Return asset-removal failures from skill uninstall instead of reporting removed while a managed file survived, and add assets_removed and directory_retained so a half-removed target is visible to the next status, which reads a SKILL.md that is already gone
• Read a prompted secret through the terminal API directly rather than spawning stty from PATH, read back what tcsetattr actually applied, announce a failed restore on the terminal where the damage is, and refuse the prompt source in a build without the libc feature rather than reading with echo left on
• Support the prompt value source on Windows, which previously refused it: the prompt goes to the process's own console so a redirected stdout keeps the structured stream clean, echo comes off through SetConsoleMode and is verified by reading the mode back, and the line is read with ReadConsoleW so a secret holding anything outside the console's code page round-trips losslessly instead of arriving as different bytes
• Fix four things only a Windows run would have failed on: an enum variant and an import that are dead there, which -D warnings turns into errors; a test asserting a POSIX separator against a message that names the local path; a gate check that executed a shell script directly, which CreateProcess cannot do because it reads an executable's header rather than a shebang; and a published checksum file that Git Bash spells with a binary-mode marker where every other platform writes two spaces
• Add reference_note to CommandSpec and the v1 CLI-spec schema for the paragraph that belongs to no single argument, so prose in a generated reference survives regeneration instead of being hand-written into a file whose own header says not to edit it
• Rewrite the generated error-handling promise so it says what it means: a message never quotes a value from an argument able to carry a credential, and does quote a path, dot-path or session name, replacing an absolute rule the tool itself could not follow
• Require ShellCheck at one pinned version through install-shellcheck.sh, lint every shell script in the checkout instead of two hand-named files, refuse rather than silently skip where upstream publishes no build, provision the same pin in CI, and prove the gate finishes with its caller's stdin left open
• Verify a release build's HEAD is the tag's own commit before building and again at upload, compare an existing asset byte for byte — identical is an idempotent success, different is refused — and discard only an asset GitHub reports as never uploaded, so published hashes cannot be quietly replaced
• Upgrade noyalib 0.0.18 to 0.0.27, and pin the release workflow's action versions and runner images