hotato 0.7.2

Fixed

• hotato contract pack refuses a bundle containing any symlink (file or
  directory) instead of silently following it. A planted link could
  previously ship bytes from OUTSIDE the bundle inside the archive (for
  example a linked secret file). A packed bundle is now self-contained by
  construction; copy real files into the bundle instead of linking them.
  Found by external diligence probing the published packages.