4.0.5 — validate notices every settings change

4.0.5

validate now notices every configuration change.

It compared a handful of settings field by field and ignored layers, kinds, secrets.customPatterns, disableDefaultPatterns and maxMonolithBytes. With a config that is not part of the snapshot (include: ["src/**"]), changing classification or redaction rules still reported valid and up to date on a stale snapshot.

The manifest now records a digest of the effective settings, computed from the raw values, and validate compares it. That covers every setting — including ones no field comparison lists — and it works where masked values cannot: two different credential-shaped exclude patterns both mask to the same placeholder.

$ validate   # same config
✅ Snapshot is valid and up to date with disk.

$ validate   # after adding a layer rule
❌ config: configuration: the settings differ from the ones this snapshot was generated with (run generate)

Still open, recorded rather than hidden: 100k files ≈ 67 s (I/O bound); parallel runs with different outDirs can hit the staging lock and exit 1 rather than wait; --watch's quiet window can defer an edit made mid-run; layer/kind names from config are raw in derived fields; binary detection samples 8 KB; the monolith builds before --max-monolith-bytes rejects it.