v0.9.1

Changed

• In auto and bypassPermissions modes Castra no longer opens approval dialogs.
  Across 356 sessions over four days its hooks asked 17 times; all 17 were approved
  and ran unchanged, so the dialogs cost attention without changing any result, and
  a dialog that is always approved trains the approval of the one that matters.
  A would-be "ask" now reaches the model as context instead. A fact-based "deny" —
  failing or unfinished CI on a release target, printing environment-variable files,
  force pushes — opens no dialog and is unchanged. default, acceptEdits and
  dontAsk still ask.

Fixed

• The release gate treated an echo label mentioning a tag inside a compound command
  as a tag, so a read-only release lookup opened a dialog. Print-only and search
  segments are dropped before looking for publication, without stripping quotes
  globally, because bash -c "git tag v1" does execute its quoted text.
• Piping echo output into a shell passed the gate: echo was excluded by its first
  word even though its output was executed. Segments piped onward are now kept.
• Any compound command led by cd matched every git push, so the common
  cd repo && git push origin feature was read as a release, and git tag --list
  or a bare git tag was read as creating a tag. Compound commands now share one
  tag-aware definition.