v0.10.1

v0.10.1 rejects malformed CLI arguments before setup and removes redundant
approval audit bookkeeping. Approval gates and historical trail verification
are unchanged.

Upgrade notes

• proxy, mcp-http, mcp-listen, egress-proxy, and init now reject
  unknown flags, missing flag values, and unexpected positional arguments.
  Correct invocations that previously relied on ignored arguments before upgrading.
• Approved native ask and fail_mode: ask calls no longer add the synthetic
  state-write audit row. approval-granted remains; scripts that count rows
  will see one fewer row per approved call. Existing signed state-write rows
  still verify and display unchanged.

Changed

• Use standard Go flag parsing for proxy, mcp-http, mcp-listen,
  egress-proxy, and init; reject malformed flags before startup or file writes.
• Reuse one named-agent/default policy lookup and remove unused internal helpers.
• Stop emitting redundant synthetic state-write rows on approved calls;
  approval gates and verification of historical signed trails are unchanged.
• Consolidate contributor guidance in AGENTS.md, check its file references
  in CI, and require a whole-batch cleanup pass before release preparation.