jevnav v0.1.9

jevnav 0.1.9 — two heuristics become facts.

moved is now excused only when the trace's run.tool differs from the running
version. The page-identical rule had swallowed real DOM reorders — same version
and the same fingerprint set means the order can only have changed on the page.
The reason names both versions, and TraceWriter records tool by default, so
every trace carries the ground truth (the pytest plugin's traces were missing
it).

The pytest plugin rewrites a literal value to value_from_env only when the
variable name looks like a secret (TOKEN, KEY, SECRET, PASSWORD, PASS,
CREDENTIAL, AUTH). A path that happens to equal $PWD or $HOME stays a
literal and says why — rewriting it used to replay as another machine's value.

210 tests (209 pass, 1 skip).