Wisp 0.1.0

Feature parity release with the Codex desktop app's Computer Use, based on an audit of what it ships.

Added

• Per-app instructions: the first state of an app now starts with app-specific guidance, like Codex's
  AppInstructions. 19 built-in files (Slack, Notion, Spotify, iPhone Mirroring, Music, Numbers, Clock, Finder,
  Safari, Mail, Notes, Messages, Calendar, Terminal, Xcode, System Settings, Chrome, a generic browser block for any
  app that handles http links, and Chrome DevTools tabs). Guidance is keyed by bundle id, bundle name or app name,
  concatenated, delivered once per session (--instructions repeats it, --no-instructions suppresses it), and
  can be overridden or extended with ~/.config/wisp/instructions/<bundle id>.md (instructionsMode
  merge|replace|off). wisp instructions list|show --app X explains what applies.
• Model guidance parity in the skill: tool choice, observation discipline, blockers, app resolution, newline
  hazards in composers, interruption phrasing, and a four-tier confirmation policy in
  skills/wisp/references/confirmations.md.
• Per-app approval with risk tiers: high-risk apps (System Settings, Terminal, Keychain, Passwords, Mail,
  Messages, Finder) prompt "Allow Wisp to control X?" with once / session / always / deny; a forbidden set
  (login window, SecurityAgent, Wisp itself) can never be allowed; grants persist in
  ~/.config/wisp/approvals.json (wisp approvals list|clear); URL hosts can be blocked
  (wisp policy set --block-url host).
• An observing lens indicator with activity states (idle, observing, acting, paused) that shows while Wisp reads
  a window even when the cursor is hidden; the menu bar and banner say whether Wisp is reading or acting.
• Lock-screen monitor: locking the screen cancels the running action, hides the overlays, and invalidates state
  so the next read is a full tree; wisp status reports screenLocked and activity.
• Chrome over DevTools: file uploads without a native panel (wisp chrome upload), JavaScript alert/confirm/
  prompt handling (wisp chrome dialog), agent-tab lifecycle with deliverable/handoff marks
  (wisp chrome mark; a bare wisp end closes unmarked agent tabs), and hidden-by-default launch with
  wisp chrome show|hide and wisp chrome launch --visible.
• Background launch parity: wisp launch and the MCP wisp_launch start apps in the background
  (--activate opts in) and wait for a real window; wisp_turn_end MCP tool; MCP cancellation notifications
  cancel the running action; interruption errors read as plain sentences.
• Settle detection waits for visible progress indicators; banner text and hint are configurable
  (wisp policy set --banner-text, --banner-hint, --lens on|off).

Fixed

• wisp apps --running no longer lists multi-process apps (Chrome, Electron) more than once.
• wisp launch refuses to start an app while the screen is locked instead of leaving a windowless process behind.

Changed

• Policy defaults: Terminal, Keychain Access and Passwords moved from the deny list to the high-risk approval
  tier; the login window and SecurityAgent are forbidden outright. Password managers stay denied.