microagent v0.16.0

Changed

• The bash tool tells the model which shell it runs. The name is bash and
  the shell has always been /bin/sh -c, so a model writing [[ ]], arrays,
  local, $'...' or process substitution saw a tool called bash and wrote
  bash into a sh. The description sent on every run now says POSIX sh and
  names the syntax that fails, and the tool table in docs/usage.md says it
  too. Nothing about how a call is executed changed: a command that failed
  before fails the same way, and the only thing that changes is what the model
  is told before it writes one.

Fixed

• A write, edit, multi_edit or microagent setup that reports success now
  survives the machine stopping. writeFileAtomic renamed the temporary file
  over the destination without first flushing it, so a power loss between the
  rename and the disk taking the bytes came back with the name in place and
  nothing behind it: a source file the tool said it wrote, read back empty or
  half-written. The flush is before the rename and costs one disk round trip per
  file written, and a flush that fails leaves the destination exactly as it was.
  microagent update and the first-run config write already did this; this was
  the one writer that did not.

• Read a compressed answer from a remote HTTP MCP server. The client sends
  accept-encoding: gzip, deflate and now reads a body its own Content-Encoding
  header names, for a frame and for a refusal alike, rather than passing the
  compressed bytes to the JSON parser. A tools/list catalog is the answer that
  benefits most; the 4 MB response ceiling and the 256-level nesting guard
  already count decoded bytes, so neither is widened by this.

• microagent update spends the Retry-After a refusal names, where the agent
  run already did. The wait is capped at 30 s, this command's own backoff cap, so
  a person watching the command is not left waiting on a run that has given up on
  their side. A refusal that names no wait keeps the previous backoff, and so does
  one naming a wait already spent (retry-after: 0, or a date this machine's
  clock has passed), which took the backoff's place and sent every attempt
  milliseconds apart.

• The benchmark venv is built for the interpreter its lock resolves for. The
  README's uv venv named none, so uv took whichever interpreter it found
  first on PATH: a host whose default is 3.11 installed a lock compiled with
  --python-version 3.12 into an interpreter a release below the floor the
  manifest states, and the adapter's own from datetime import UTC is a 3.11
  name, so the run failed at the first summarize rather than at the install.
  make lint-versions now holds that --python against the floor the linter
  manifest, the Harbor manifest and ruff.toml are already held to, and its
  self-test asks the same question of it as of the other four.

• The git tool honors rev on cmd = "log" to narrow commit history. The
  tool schema declared the field for the commands taking one, but log dropped
  it silently and returned the entire log. cmd = "status" now explicitly
  refuses rev, explaining that status reports the working tree against HEAD.

• Remote preset configuration keys (url, api_key_env, api_key_header,
  timeout) written under built-in tool tables like [tools.bash] report the
  table name in the diagnostic message instead of an unspecific unknown-key
  notice.