v0.40.0 — single source of truth + auto-commit by default

Two behavior-changing features (existing users: your defaults change on upgrade).

Single source of truth for memory

hunch shared --repo <url> is now unified — every capture (decisions, bugs, constraints, runbooks) routes through one resolver to one home, so nothing splits between the public and shared stores.

• Worktree-stable: the overlay anchors at the main worktree root, so a git worktree remove can no longer silently take the store down.
• Team auto-discovery: a committed .hunch/team.json advertises the store — a fresh clone auto-connects on hunch init, and any MCP-connected agent or CI job wires up the same way on server start. Everyone, on every branch, resolves the same memory.
• --repo never silently ignored: same remote → pull; no remote → attach + merge + push; different remote → hard refusal.
• hunch doctor now reports the true mode and shouts a dead-pointer finding instead of silently reading empty memory.
• Mode is persisted with no schema bump — existing setups keep their current behavior until you explicitly re-run hunch shared.

Auto-commit ON by default, in every mode

A capture is now committed to whichever store it lands in without being asked: a private/shared overlay repo is committed and pushed; the public .hunch/ is committed only and rides your next push — Hunch never pushes or merges your code branch. Opt out with --no-auto-commit on init / private / shared.

Security

.hunch/team.json is committed, so in a freshly cloned untrusted repo its URL is attacker-controlled and auto-consumed on MCP start. The clone now runs behind a strict URL allowlist (https / ssh / git / scp-style only) plus -- and a protocol kill-switch, so a smuggled git flag or ext:: transport can never turn opening a repo into code execution.

Full test suite: 385 pass.