v0.7.5

[0.7.5] - 2026-09-02

This patch is a fix-forward release for the npm wrappers. The immutable
0.7.4 npm versions were published under release-candidate, were not
promoted to latest, and remain available by exact version. Acceptance found
cross-platform first-use installation defects, so an accepted 0.7.5 release
is intended to supersede those candidates rather than overwrite or withdraw
them. This changelog entry and repository source do not prove that a v0.7.5 tag, GitHub Release, package,
registry entry, deployment, or customer acceptance exists.

Fixed

• Open downloaded native binaries read/write before fsync, preserving the
  durability barrier on Windows where FlushFileBuffers rejects a read-only
  file handle.
• Normalize extracted Unix release binaries from archive mode 0755 to the
  private cache mode 0700 before applying the strict owned-path policy, then
  verify the installed executable retains that private mode.
• Apply the same portability behavior and regression coverage to both the
  phantom-secrets and phantom-secrets-mcp wrappers.
• Preserve a checksum-matched previous-version cache byte-for-byte until the
  replacement binary and manifest are fully verified and atomically promoted;
  failed downloads, extraction, flushes, or version checks leave no transaction
  debris and never execute the prior binary under the new wrapper version.

Breaking changes and migration

There are no intentional CLI, MCP, configuration, vault, or network-policy
breaking changes. Users who explicitly installed an npm 0.7.4
release-candidate should install exact 0.7.5 only after its public
integrity and native acceptance receipts are available. Do not rely on an
unpinned dist-tag while the fix-forward candidate is still under review.

What's Changed

• fix: harden v0.7.5 release candidate by @masonwyatt23 in #101

Full Changelog: v0.7.4...v0.7.5