v0.4.1 - security update

Security update, 2026-10-28

• aid-token.sh: the auth server URL is passed to jq as an argument, never spliced into the program text; the token cache is created 0600 and its directory 0700.
• aid-helper.sh: the private key is generated under umask 077.
• gateway and verifier: engines.node is now >=22 (Node 20 is end of life). Both packages have no dependencies and npm audit is clean.

Open: install.sh run through curl | bash downloads from the main branch without a checksum. See CHANGELOG.md.

v0.4.0 — Lean skill that says when to use it

Agent Identity (AID) v0.4.0

• The description says when to use it: signing an agent in to an AID-enabled server, getting or refreshing an access token, or proving its identity to an API.
• The body is lean and task-shaped (2,670 → 878 tokens). Protocol detail moved to references.
• Example dates no longer expired.
• The plugin manifest version now matches the skill (0.4.0).

Measured as part of the AI Maestro plugin: its trigger suite went from 13/16 to 16/16 (details).

PRs: #20, #21, #22.