argus 0.4.0-rc.1

argus 0.4.0-rc.1

A release candidate, and the first tag release.yml has ever run on. It exists
to find out where the release stops before the real tag does. It is a
prerelease: install.sh never resolves it as latest, and the Homebrew formula is
never bumped to it.

0.4.0 is argus as an installed binary. Every command runs from one binary that
carries its doctrine, and nobody clones argus to use it.

• A Project's .argus.yml pins an Overlay by URL and ref; argus overlay pull
  fetches it, and review, gate, sync and dast take their Profile from it.
• sync is bound to the Project: it installs the two agents, the skills they
  name, and the pre-flight checklist at .claude/argus/RULES-OF-ENGAGEMENT.md.
  Every path the shipped doctrine names is one the Project has, and lint
  refuses a build where that stops being true.
• review and gate take the repository you are standing in; a directory that is
  no repository is refused with the reason and both ways forward.
• doctor, toolbox, verify and dast are new. dast runs behind a guard that
  refuses production, proves ownership live, and reports a stage it cannot
  show examined the target as SUSPECT, never as done. No real staging target
  has been scanned with it yet.
• Toolbox images are pinned by the digest injected at release and pulled by it,
  never by a tag. They are public packages; pulling needs no login.
• Releases are published from the public karibew/argus-cli. Installing needs
  no token: brew install karibew/tap/argus, or install.sh.

Two user-visible breaks from 0.3.0: the config schema is version 2, and
sync is gone - sync takes the Project it is run in.

This release is not signed. SHA256SUMS catches a corrupt download and proves
nothing about who built the bytes; provenance is an open decision recorded in
docs/adr/0008, to be settled on a candidate like this one.
-----BEGIN PGP SIGNATURE-----

iJEEABYKADkWIQTKKELDW9dCd1WCColBoKZCVabq8AUCaq2KThsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwwLDMACgkQQaCmQlWm6vASsAEA+Cg+iy4WIz8GzyqG571G
56qhGKysYMsSBS1iBDoJOBcBALg/hk1JDCL6vxRtxZdVaBqbqY2tHOcK+4bDbzdm
MR0B
=U8wu
-----END PGP SIGNATURE-----