v0.2.0

Recommendation-only auto planning, and the repository stops being trusted config.

gator auto plan reads one committed file you name and recommends a single unit of
work from it. It recommends only — no worker starts, nothing is merged.

gator auto plan  --from SPEC.md     # recommend one unit
gator auto show  --plan <plan-id>   # inspect it, and whether it still applies
gator auto plans                    # what has been planned here

The result is canonical, hashed JSON bound to this checkout, the branch, its HEAD,
the source's committed blob and the selection policy. Change any of them and the
plan stops applying; show names which one. "No suitable work" is a normal,
successful answer and exits 0.

Selection is deterministic and explainable — a rubric of benefit, clarity,
boundedness and risk, with every rejection carrying its reason. The planner runs
with no tools at all, and the source it reads is fenced as untrusted data.

The repository is no longer trusted configuration

.gator/ lives inside the repository, and a repository can commit its own —
.git/info/exclude suppresses only untracked files. So a clone could arrive
carrying a roles file naming the command to run, or a verify file that would
be executed. Both are now ignored unless you opt in:

GATOR_TRUST_REPO_CONFIG=1 gator ...   # this repository's .gator/ is mine

Without it they are skipped with a note on stderr. Set it only for repositories
you wrote. Model references are validated before substitution, so one cannot
carry a subshell.

Also

• Structured unit records: base SHA, target ref, the exact verifier that ran and
  the commit it verified. A unit that exits nonzero without committing is now
  failed, not empty — the failure cause outranks the absence of output.
• gator status --json and --no-merge are pure reads: no merge, no worktree
  removal, no reported marker.
• Planning is rate limited — cooldown, budget, one at a time — because each call
  costs a model request and a full verifier run.
• Planner output is streamed against a hard cap rather than buffered and then
  measured. Control characters in planner strings are refused, so a model cannot
  rewrite the terminal output that judges it.
• The store is 0700 with 0600 files: it holds prompts, model output and
  verifier logs.

Not in this release

gator auto run does not exist. Execution arrives once the safety tests for it
pass; until then auto plan produces something for a human to read and act on.
Worktrees protect integration, not the machine — see the security model in the
README.