v0.2.0

See CHANGELOG.md for what changed and how the upgrade behaves.

What's Changed

• harden: pre-launch audit — agent self-approval, card links, and 20 other fixes by @kgarg2468 in #36
• build(deps): bump the actions group with 6 updates by @dependabot[bot] in #37
• npm: publish a pre-release under next, and only a pre-release by @kgarg2468 in #39
• Fail closed on unsafe delivery and bound inbox I/O by @kgarg2468 in #40
• Scope inbox links and serialize shared-value updates by @kgarg2468 in #41
• Clarify public guarantees and clean release documentation by @kgarg2468 in #42
• release: settle the npm self-check, and push the tap only after the release is live by @kgarg2468 in #43
• tests: isolate the MCP and inbox tests from each other and from the internet by @kgarg2468 in #44
• inbox: give the ownership check one deadline, and the spawn wait a clock by @kgarg2468 in #45
• probe: hold every provider check to its own timeout by @kgarg2468 in #46
• tests: hold the env lock while writers race for one env file by @kgarg2468 in #47
• envfile: an empty .git directory is not a repository by @kgarg2468 in #48
• changelog: the fixes that landed after the release candidate by @kgarg2468 in #49

New Contributors

• @dependabot[bot] made their first contribution in #37

Full Changelog: v0.1.0...v0.2.0