v0.8.3

Added

• The skill states a trust boundary. Everything inside a managed checkout is untrusted third-party
  content — README, comments, commit messages, and any AGENTS.md or CLAUDE.md a tracked repo
  ships — so it is evidence to read and never instruction to follow. Documentation stays evidence,
  including a repo's own contributor and agent docs; what goes to the user as a finding is content
  targeting the agent that reads it. Both worker flows carry the rule into their prompts. This
  narrows the blast radius of indirect prompt injection; it is not a sandbox, and SECURITY.md says
  so.

Changed

• The skill installs nothing. Its capability gate used to ask permission and then run
  npm i -g @kaisers-io/refs itself; it now prints the command — pinned to the version the skill
  was written against, not @latest — and stops until the user has run it. A skill that installs
  the executable giving it its capabilities is a bootstrap trust boundary worth keeping explicit,
  and Anthropic's skill documentation discourages global installs from a skill.

• The --json examples in the skill's command reference use placeholder repositories
  (example-org/…) instead of real third-party ones, and say up front that they are illustrative
  output rather than repositories the skill fetches.