v0.2.4

Added

• Repo-local .machine.toml config: bare machine up can infer a project from
  the current directory, use the repo's origin remote when repos is omitted,
  and make bare ssh/claude/down/destroy/secrets target that local VM.
• machine create [name]: an interactive wizard that writes a project entry
  to projects.toml (repos, profiles, shell, agent forwarding) or edits an
  existing one — prompts default to the entry's current values, and comments
  elsewhere in the file are preserved. machine up <new-name> and a bare
  machine up (when no default VM or entry exists yet) launch the wizard
  first, then continue into provisioning; machine up default keeps the
  zero-config scratch-VM behavior. Unknown names no longer get the bare
  "create a base VM? [y/N]" prompt.
• Per-project forward_agent = false in projects.toml: the generated Lima
  template overrides ssh.forwardAgent, so the VM gets no channel to the host
  SSH agent — pair it with a per-repo deploy key for the strictest setup.
  machine up warns (instead of failing) when the clone needs that deploy
  key, and the agent self-heal step skips such VMs.

Changed

• README, SECURITY.md, and the docs site now describe what agent forwarding
  actually grants: the VM never reads private keys, but while a forwarded
  connection is open it can sign and authenticate with every key the agent
  holds — any repo the key authorizes, not just the project's. A new
  "Restricting the forwarded agent" section covers per-use approval
  (1Password), confirmation-gated keys (ssh-add -c), and deploy keys.

Removed

• machine tab (the macOS new-tab helper). It drove Terminal.app via
  AppleScript and did not work reliably.

Fixed

• machine ssh and machine claude now rebuild a stale Lima SSH master that
  forwards an empty agent, so 1Password-backed commit signing works once the
  agent is available.
• The host-side ssh-add -l agent probe is now time-boxed (5s). A wedged or
  locked 1Password SSH agent accepts the socket connection but never answers,
  which previously hung machine ssh/machine claude indefinitely at the
  self-heal step; the timeout now counts as "no keys" so the command proceeds.