v0.21.0

govctl v0.21.0

0.21.0 runs verification guards in a non-login shell. Guards previously ran
under bash -lc, which re-read /etc/profile and the user's bash profile, so
PATH could be reordered (for example by macOS path_helper) and variables
overridden. A guard could then use a different python, cargo, or node
than the active virtualenv, Nix shell, or CI job. This is a breaking change for
guards that relied on profile files to find their tools: provide that setup in
the environment that runs govctl, or source it in the guard command.

Fixed

• Guard commands inherit the invoking process environment unchanged: a
  caller-prepended PATH entry stays first, and login-shell and user profile
  startup files are no longer loaded. (WI-2026-10-01-001)

Full Changelog: v0.20.3...v0.21.0