v0.9.0

The CLI becomes a named principal and the empty-principal era ends. Library
schema advances 4 -> 5; every existing data dir migrates once via
yoloai system migrate.

Breaking changes (see docs/BREAKING-CHANGES.md):

• Runtime instance names are principal-scoped; the empty principal is invalid.
• Profile image tags are principal-scoped (yoloai- -> yoloai-cli-).
• Config commands reject unknown paths; config set requires a leaf key.
• yoloai system migrate refuses a data dir it cannot fully read.
• yoloai reset refuses a sandbox with unapplied changes (--abandon-unapplied to override).
• yoloai new <name> refuses when a sandbox of that name has unreadable metadata.

Data-integrity hardening: environment.json and every per-sandbox record are now
written durably (atomic temp+fsync+rename); the migration aborts rather than
certify a sandbox it could not read; create never wipes a real-but-unreadable
sandbox.

---

Install: download the archive for your platform below and extract the yoloai binary,
brew install kstenerud/tap/yoloai, or go install github.com/kstenerud/yoloai/cmd/yoloai@latest.
Verify with checksums.txt (+ the cosign signature / build provenance).