v0.18.1

• Stream SSH archive bodies through bounded binary frames and incremental hashes instead of whole-file base64 copies; preserve deadlines, verified server receipts and committed local paths.
• Retain cleanup ownership across cancellation, failed closes and forked KnownHosts snapshots; reject inherited trust commits before file or lock access.
• Preserve the primary exception or nonlocal exit when atomic-file and archive-process cleanup also fails.
• Expose JSON Pointer field provenance through configuration previews and leave runtime dependency versions to host lockfiles.