v0.3.1

This release resolves findings from a full security and correctness audit of the plugin. No user action required; upgrade in place.

Security

• Release CI no longer interpolates untrusted input into shell and pins all GitHub Actions to commit SHAs, closing a workflow injection / supply-chain path.
• Diagnostic dumps and log files are now written with private permissions (0600/0700), and credentials are redacted from dumped request bodies.
• main is now a reserved account id and cannot be used as a fallback label; the OAuth callback no longer discards a pending login on a code-less request.

Reliability

• The account killswitch no longer fails open on the WebSocket transport after a main-account re-login.
• A failed fallback account now records its quota, so the killswitch won't immediately retry an exhausted account; quota windows past their reset time are no longer treated as exhausted.
• Account fallback is restricted to the Codex responses endpoint and no longer retries after an indeterminate transport error, preventing duplicate requests.
• A crashed token refresh can no longer stall subsequent refreshes, and a rotated token is no longer lost if persistence briefly fails.
• First-run multi-account migration is serialized with account edits, and removed accounts are no longer refreshed.
• Fixed a file-lock recovery race that could surface under heavy concurrent load.

Internal

• HTTP request bodies are key-ordered to match the WebSocket path, avoiding a prompt-cache miss on transport fallback.
• Added CI test coverage for the Pi package.