v0.4.9

• Release: 0.4.5 through 0.4.8 were tagged while bringing up the signed release automation and were never published; they carry the same code as this release.
• CLI: accept --radius as an alias for --radius-m on search, nearby, autocomplete, and route.
• Docs: validate generated llms metadata as plain text and keep the metadata helper import-safe. (#29) - thanks @vincentkoc
• Docs: rewrite the README around verified install, quick-start, and reference paths.
• Release: accept interpolated Cask URLs and make completed release reruns idempotent.
• Release: keep the pinned GitHub transport reusable across shell command substitutions.
• Release: accept the reviewed Homebrew revision of the pinned Node 26.5.0 toolchain.
• Release: bind the pinned Go toolchain to its canonical Homebrew root across isolated build and signing steps.
• Release: run credential-free release contract suites with the frozen jq 1.8.2 parser.
• Release: refresh the reviewed release toolchain pins to GitHub CLI 2.98.0, GoReleaser 2.17.1, Node 26.7.0, and Python 3.14.7.
• Release: accept the reviewed release-mac-app helper revision that scrubs package signing authority and narrows credential inheritance.
• Release: resolve the signing account's keychain domain in the Darwin codesign hook so official signing works under the producer's isolated HOME.
• Release: accept GitHub's release-body newline normalization, the untagged asset URLs GitHub serves for drafts, and its JWT-style Actions tokens.
• Release: match redirect headers without awk IGNORECASE so asset downloads work under the macOS awk the verifier runs on.
• Release: compare distinct verifier proof markers, since a run log archive repeats every line in both its aggregated and per-step entries.
• CI: install the reviewed GitHub CLI before the release contract suite instead of inheriting the runner image's version.
• Security: require Go 1.26.7 and scan both source and built binaries with pinned govulncheck. The 1.26.6 floor landed in #30 - thanks @vincentkoc
• Build: update golangci-lint to 2.13.1 and staticcheck to 0.8.1 for Go 1.27 support.
• CLI: report the tagged module version for go install github.com/steipete/goplaces/cmd/goplaces@latest; linked release versions still win and local builds remain dev.
• Release: sign and notarize official macOS binaries with the OpenClaw Foundation Developer ID while keeping ordinary and cross-platform builds credential-free.