v0.2.1

fix: instance .env is owner-only — it holds forwarded provider API keys

renderEnv forwards every provider key present in the caller's shell into
the instance's .env, but the file was written with the default umask, so
on a normal macOS setup live API keys sat at 0644. Found a stale, never-used
instance still holding a readable Google key.

.env is now written 0600 and the instance state directory (including its
config/ child, which one recursive mkdirSync covers) 0700. load() runs on
essentially every command, so it also heals instances created by older
versions — guarded, because a foreign-owned or read-only .env must not take
down a plain `list`.

Verified live: a fresh create lands 0700/0700/0600 with a key really in the
file, and both pre-existing instances went 0644 -> 0600 on the next command.

Closes #3