v0.2.5

Fixed

• regroup --apply re-checks that the user is still in the replacement group right before
  removing their direct grant; if not, or if the lookup fails, the grant is kept and the
  step is reported as MANUAL (exit 1). (#13)
• CI: the checkout step sets persist-credentials: false, so the job token is not left in
  .git/config for later steps to read. (#15)