v0.4.0 — skills-based init, chain-guard hardening

Setup became a skill, and the chain guards were brought in line with what the
documentation already promised.

Install

curl -fsSL https://raw.githubusercontent.com/makedirectory/ModelPeer/v0.4.0/install.sh | bash

Docs: https://modelpeer.app

init stops touching your files

In 0.3.0 init wrote your AGENTS.md and symlinked CLAUDE.md and GEMINI.md
to it. A tool that rearranges someone's root context files uninvited does not get
run twice. It now installs self-contained agent skills and nothing else:

.claude/skills/cross-model-review/SKILL.md      .claude/commands/peer-review.md
.claude/skills/cross-model-consult/SKILL.md     .claude/commands/peer-ask.md
.codex/skills/...                               (both, per CLI)
.gemini/skills/...

AGENTS.md, CLAUDE.md, and GEMINI.md are never read, written, or symlinked.

Two skills, because the tool does two things that fire on different cues:
review cross-checks a diff across the whole panel, consult gets one peer's
opinion on one question.

Skill discovery was verified against the shipping CLIs rather than their docs:
gemini skills list reports them, a codex exec run lists them among its
skills, and Claude Code quotes their descriptions back from the system prompt.

New commands

model-peer update [--check]   # refresh installed skills; --check is the CI form
model-peer trust              # let Gemini load this project's skills

update only touches files that already exist and that Model Peer wrote, so it
cannot quietly widen what is in your repository.

Only Gemini needs trust — Codex loads project skills untrusted, and Claude Code
prompts once interactively. It adds one TRUST_FOLDER entry to
~/.gemini/trustedFolders.json and nothing else. Folder trust is a security
control, so init never does it for you.

Fixed

Four documented guarantees were stronger than what the code enforced. Each was
reproduced before being fixed, and each has a regression test.

• A model could appear twice in one chain. The guard compared only the tail
  of MODEL_PEER_STACK, so claude → claude was blocked while
  claude → codex → claude was permitted.
• A peer could raise the ceiling it inherited. --depth beat the inherited
  MODEL_PEER_MAX_DEPTH. It is now a hard cap inside a chain.
• Synthesis was unbounded. Reviewers were bounded by --timeout; the
  synthesis call was not, so a hung synthesizer could hang a completed run.
• A delegating Claude peer was over-granted. Bash(model-peer:*) stopped
  being read-only once init and update existed. Delegation now grants
  Bash(model-peer _delegate:*) only — an entry point that inherits every limit,
  takes no options, and cannot reach init, update, review, or trust.
• Temporary directories are removed on interrupt, not only on the normal path.

Changed

review no longer accepts --depth. Reviewers and the synthesizer are always
leaves. Reviewers that can consult one another are not independent observations,
which is the entire value of the panel. ask explores; review cross-checks.

Corrects a 0.3.0 claim: .codex/rules/ is a real directory Codex reads, but
it holds Starlark .rules files governing command execution, not agent context.

Full notes in CHANGELOG.md.

Full Changelog: v0.3.0...v0.4.0