v0.2.1

[0.2.1] - 2026-08-07

Added

• numan update --self: upgrade the numan CLI itself. Standalone installs download the matching GitHub Release asset, verify the Ed25519 signature over SHA256SUMS (SHA256SUMS.sig + baked-in release public key), then check the archive digest and replace the binary. Homebrew / winget / cargo installs print the exact upgrade command instead of self-replacing; --check still queries GitHub Releases to report whether a newer version exists before printing that hint. The Release workflow now hard-fails if NUMAN_RELEASE_SIGNING_KEY is unset so every published release ships SHA256SUMS.sig.
• SECURITY.md: vulnerability reporting, scope, and cross-repo trust summary (linked from the README)

Changed

• numan search / numan info: scripts and completions are labeled install-only (activation deferred) instead of module-style "not ABI-locked" wording; install-only labels still appear when Nu is unknown
• numan try: prefers activatable curated starters (plugin/module), then falls back to Nu-agnostic install-only scripts (SuaveIV/nu_script_wttr, Sanceilaks/nufetch) without calling activate; prints a quoted overlay use path from the installed lockfile entry