v0.0.67

Windows

• git.safeDirectories config — safe.directory without write grants; fixes dubious-ownership on subdirectory launches (also emits on macOS/Linux) (#403)
• Deny targets that don't exist yet are materialized as placeholders and stamped, closing the create-past-a-deny hole; trailing / marks directory targets (#404)
• Kill-chain hardening: broker error paths always reap the runner; CI smoke rows pin the no-survivors invariant (#405)
• Persistent MITM CA: ca.json under the protected state dir, atomic writes, notBefore/notAfter validation, auto-load at initialize(), generateCa/validateCaPair exports (#406)
• Breaking: windows.srtWin.path is required — no implicit vendored-exe fallback; pass the exported VENDORED_SRT_WIN_EXE to use the packaged binary. Fact-only argv-too-long message (#413)
• Typed WindowsSandboxError codes with .subcommand, single-spawn srt-win status --json + checkWindowsSandboxStatus() (#414)
• Typed mapped_drive_cwd error (exit 16) for network-drive working directories; the broker never stats UNC literals (#415)
• Async dependency/status/install APIs (checkDependenciesAsync — additive, sync API unchanged); install/uninstall timeout default 120s; windowsHide on sync spawns (#395)