v2.0.1 — Deployment hardening

Deployment-hardening release: no new features — every fix from an exhaustive 5-domain code review of v2.0.0, adversarially re-verified by execution, plus 4 rounds of bot-review follow-ups (final verdicts: Claude "ship it", Copilot "no new comments").

Highlights

• macOS sync fixed end to end. BSD xargs -I limit made one page permanently unsyncable; mapfile/shuf were dead on stock bash 3.2. A new shell-macos CI job now runs the shell suite under BSD userland on every PR.
• Session-hook wedge fixed. Hook timeout was below its own clone budget and could wedge installs forever. Self-heal now verifies git resolves to the docs dir itself (a lost .git under a git-managed $HOME could previously hard-reset your own repo), preserves cache/ and courses/ across repair, and never nests a fresh clone into a half-deleted dir.
• No more churn commits every 3 hours. Metadata commits now land only when content actually changed (~2,900 no-op commits/year eliminated — each used to trigger every user's session-hook re-sync).
• Search survives doc-site outages. Index carry-forward keeps previous search data for pages whose fetch failed; safeguards count real per-run fetch successes and run before anything is written.
• Security hardening. Real DTD/ENTITY rejection over the full sitemap (previous XXE guard was bypassable; the one before that was entirely dead), manifest-filename traversal guard, ALLOWED_DOMAINS enforced, redirects uniformly treated as fetch failures across client, fetcher, discovery, and monitoring.
• Discovery fail-closed with retries. A dead source aborts the run (previous manifest stays; clients unaffected) — but transient blips are retried with backoff first.
• CI honesty. No more || true around tests or fake coverage numbers; actions SHA-pinned; PR workflows gated for forks.

Full details: CHANGELOG.md → [2.0.1]. Plugin version bumped to 2.0.1.