v0.11.0

Changed

• pitboard forget, pitboard stow and pitboard uninstall delete nothing without
  --yes where they cannot ask: through a pipe, from a script or a tool, or with --json,
  which no longer stands for --yes. Each refuses with the error confirmation_needed,
  exit status 2, before it changes anything. Breaking for a script that runs any of them:
  pass --yes. Until this, each went ahead without asking, and pitboard stow < /dev/null,
  run as a look, deleted a login file behind the keychain. At a terminal each still asks.
  stow with nothing to put away or a login of an account not enrolled, and forget of a
  label that names no account, answer as before, and so does each as root or under sudo.
• The account index is schema 7. It lists a renewal of Claude Code's login that Pitboard has
  not saved where Claude Code keeps it yet. An earlier Pitboard cannot read it once this one
  has, and says to update, so update the command line and the app together.
• Where Pitboard renews Claude Code's login to identify it and Anthropic no longer accepts
  it, or it has no refresh token, session_expired says to run claude and sign in, with
  the cause login_refused. Everywhere else it still says to run claude once, with
  token_expired. A read that finds the login in use refused for good marks that account
  login_refused, with Claude Code's login is no longer accepted; run `claude` and sign in again.

Fixed

• Pitboard renews Claude Code's stored login where it must tell whose that login is and
  its access token has expired, as Claude Code renews it, under its refresh lock. Claude
  Code renews it only while a session uses it, so with every session signed in with
  ~/.claude/.credentials.json behind the keychain, nothing did: a switch and pitboard stow stopped at session_expired, and the automatic switch said not_identified at
  every look. A login a session renewed meanwhile is used, with nothing sent. A read renews
  it only while no other Pitboard command runs, asking for usage never renews it, and
  pitboard stow's question takes it from the account Pitboard last recorded. Codex's
  login is never renewed this way.
• A renewal of Claude Code's login, by pitboard stow or to identify it, keeps a copy of
  Anthropic's answer in Pitboard's store, pitboard-park-renewing-<time>, until the answer
  is saved where Claude Code keeps it. Killed in between, or with the file's write failing,
  stow left a spent refresh token in the file and lost the renewed login. The next
  change, or the next read that must renew the login, saves the copy. Until then no change
  renews, parks, replaces or puts away that login, each saying why the copy cannot be saved
  yet, and pitboard uninstall keeps ~/.pitboard. Where pitboard stow renewed the login
  stored and could not save it yet, its error ends by saying it keeps the renewed login. The
  copy is named in Pitboard's index before the refresh token is sent, so a keychain locked
  by then stops the renewal with nothing sent. On macOS, where the keychain cannot ask for
  its password, as over SSH, one that locks while Anthropic answers takes neither the copy
  nor the renewed login. A change then says the login's refresh token is spent and to run
  claude and sign in, and a read marks the account in use login_refused.