v0.9.1

• Upgrade to Agent-First Data 0.31.0 and adopt its bound-action outcome, so a resolved invocation carries its own handler and runs itself instead of being routed through a separate dispatch call
• Add a coverage test that drives every registered command shape through its handler, so an arm reading an argument id its shape cannot supply fails the test suite instead of silently degrading to an empty value at runtime
• Stop echoing the offending token in CLI rejection messages — the message now names the failure category and the hint names the command to run — so a logged rejection never carries a value the caller supplied
• Document the two exit-1 codes that describe a defect in the tool rather than the call: cli_invocation_invalid for a resolved invocation the program cannot read back, and output_setup_failed for an output sink that could not be established
• Rebase the container images on Debian trixie across the builder, downloader, and runtime stages
• Update alloy to 2.3