v0.3.1

CLI-Router 0.3.1 is a patch release focused on correctness, process cleanup, configuration safety, provider command compatibility, and release hardening.

• Made workflow outcomes fail closed: run and implement now reject empty resolved stage lists, and stop_on_failure: false preserves the first failed stage as the overall result even when later stages succeed.
• Terminate the full subprocess process group on command timeout so provider helper processes do not survive an exit 124.
• Restored home-config-only TUI persistence; project-local and explicit configuration files are no longer silently rewritten.
• Updated generated Hermes commands to the current non-interactive hermes --oneshot interface and corrected Grok --single argument ordering.
• Hardened Doctor repair backends to run tool-free/read-only from an isolated temporary directory without GitHub repository tokens; providers without a safe tool-free mode are excluded.
• Changed model drift removals to require explicit maintainer confirmation, isolated the patch agent from GitHub credentials, added a strict patch-file allowlist, and removed auto-merge from the watchdog.
• Added release identity validation, Python 3.14 CI, Ruff, mypy, actionlint, branch-aware coverage, package checks, script tests, and Dependabot configuration.