v0.3.0 — a policy you can start, and an approver who can see

• obstat init writes a starter policy — every rule commented out, one live
  deny — and refuses to overwrite the file that is the only thing standing
  between an agent and every guarded tool. obstat check answers what the
  policy would decide without a call to make it decide, exits 0 only on allow,
  and reports a broken policy instead of leaving it to the next real call.
• record_args (schema 4): a tool names the parameters whose values go on
  the record, and obstat pending prints them under the row — because an
  approver deciding about sha256:ae32e6… is deciding about nothing. The
  digest still covers every argument; values are written beside it, never
  instead of it.
• OBSTAT_APPROVAL_TTL makes the approval window configurable; a value that
  cannot work raises instead of being silently replaced.
• §8 (what is weak) and §10 (what is next) written down, including that a
  resource id is caller-controlled text matched byte for byte (§3.3).