v0.2.0

Changelog

• d872e25 search: emit source and cageable in --json, the fields the skill tells an agent to read (it had only ever computed them for the table, and the record's own repository.source means something else); skill v9 requires 0.2.0; CONTRIBUTING documents cutting a release and when to bump the skill's requires
• 0be7e55 egress: an untagged tag releases the live run it names (allow @me/weather said 'Allowed' while the cage stayed held), a held host now rides on a successful tool result so a server that swallows the block cannot make a caged run look healthy, serve add checks the door before building, the stale-daemon line stops reading as a failed command; skill v8 stops approving unnamed hosts, guessing commands, and opening second doors; demo weather server for testing approval on a host worth approving
• 497b19a search: show SOURCE so a remote-only entry is visibly uncageable before import refuses it, collapse each name to its current version, and turn the empty state and both remote refusals into the package-coordinate path; skill v6 knows the registry lacks the official servers and that fetch/git/time are pypi-only
• 1bb1f01 hook: watch every MCP tool call (^mcp__) instead of only the front door's user-chosen name, correct a drifted matcher on re-init, and rank session-start events so a blocked exfil must be reported before anything else
• 1343841 version: stamp the CLI's own tag series (--match 'v*'; the newer docs-mcp-v* tags were winning and the binary called itself docs-mcp-v0.1.2) and report the serving docs server on a second --version line, read from the daemon at run time since it is never compiled in
• 8c59923 fix(registry): resolve a bare registry name to its latest version (version=latest, isLatest, then last-returned), not the first match, which pinned every pull, import, and the docs auto-serve to a publisher's oldest release