v0.3.2

Static Linux builds (musl) and macOS builds. Unix only — see the
workflow for why there is no Windows binary.

Verify before use. The attestation is the stronger check — it
proves the archive was built by this repository's release
workflow, from this commit:

gh attestation verify git-remote-sealed-<target>.tar.gz \
  --repo hibariya/git-remote-sealed
shasum -a 256 -c SHA256SUMS --ignore-missing

Then put git-remote-sealed on your PATH. It needs git;
encryption is built in, so no age binary is required.

0.3.2

Security fix. If you do not fully trust your host, please upgrade
every device.

A dishonest host could make a device accept a wrong version of the
vault. The trick: the host rejects one of the device's pushes on
purpose. After that rejection, the device forgot part of what it had
already checked. The host could then show it a version that disagrees
with what it saw before, and the device did not notice.

This needs a dishonest host and unlucky timing between two devices, so
it is unlikely. But the format promises to catch it. Now the device
keeps what it checked, and it refuses such a version with the error
"vault forked".

Nothing else changed. The vault format, your vaults, and the data each
device keeps are the same as in 0.3.1, and devices on 0.3.1 and 0.3.2
can use the same vault. See CHANGELOG.md for details.

Full Changelog: v0.3.1...v0.3.2