v0.0.11 — Security hardening

Security fixes

• Render vault directory names literally in Bash, zsh, and fish prompts and safely quote temporary-directory cleanup paths.
• Save vaults through exclusively created random 0600 temporary files.
• Remove deleted secrets from refreshed environments and validate injected environment entries.
• Verify reciprocal Git worktree registration before borrowing vaults.
• Safely encode macOS Keychain commands; roll back failed Linux cache setup and enforce expiry/TTL bounds.
• Reject overlong passphrase-file input, excessive KDF iterations, oversized vaults, and nonregular vault files.
• Verify installer checksums, use matching release-tag source fallback, and pin CI actions.
• Fix automatic shell reload and require Go 1.26.8 for source builds.

Upgrade notes

Exit and re-enter existing schain shells after upgrading: older shells lack the key inventory required for safe reload. Vault files, including history, are now limited to 16 MiB; passphrase-file first lines are limited to 4096 bytes.

Verification

Linux and macOS CI tests passed. Release binaries are available for Linux amd64/arm64 and macOS arm64 with SHA-256 checksums. Native macOS Keychain operations were not integration-tested; command encoding was checked against Apple's parser source on Linux.

Full Changelog: v0.0.10...v0.0.11