v0.3.1

Static Linux builds (musl) and macOS builds. Unix only — see the
workflow for why there is no Windows binary.

Verify before use. The attestation is the stronger check — it
proves the archive was built by this repository's release
workflow, from this commit:

gh attestation verify git-remote-sealed-<target>.tar.gz \
  --repo hibariya/git-remote-sealed
shasum -a 256 -c SHA256SUMS --ignore-missing

Then put git-remote-sealed on your PATH. It needs git;
encryption is built in, so no age binary is required.

0.3.1

0.3.x moves the key list into the vault. Each device used to keep its
own sealed.recipients list; now the vault records the keys it is
encrypted to, and every device sees the same list. Add a key with
enroll, remove one with revoke, show them with info.

Upgrading from 0.2.x: run git-remote-sealed upgrade once per vault.
Pushes are refused until you do. See the README for the steps and the
order to do them in.

0.3.1 fixes problems found in a review of 0.3.0:

• A vault with a mismatched key list can be repaired with
  compact --repair. The key check also catches an extra key of a
  non-X25519 type, and runs after the rollback check.
• upgrade --yes handles a lost device.
• A leftover sealed.recipients no longer blocks the first push to a
  new vault or breaks revoke.
• info works offline, and error messages fit the command you ran.

Format 2 is unchanged. See CHANGELOG.md for the full list.

Full Changelog: v0.3.0...v0.3.1