v0.5.5

A patch release closing the three findings still open from the 0.5.1 and 0.5.3 stress-test audits: recall dying on the exact recurring-error case it exists for, the PowerShell hook ignoring a sandboxed USERPROFILE, and v2 error text outside signal lines being unfindable.

Fixed

• rocky recall lost results the moment the same error was recorded twice. Document frequency was counted once per stored record, so the second occurrence of the same failure pushed its own distinctive token (enospc, a package name) past the rare-token floor and recall said nothing matches. Frequency is now counted once per canonical fingerprint, in both queryRecall and searchKnowledge.
• rocky hook install/uninstall could reach the real PowerShell profile while USERPROFILE/HOME pointed at a sandbox. Probed hosts are now admitted only when $PROFILE resolves under the active home directory; a host outside it is dropped with a one-line disclosure. ROCKY_HOOK_ALLOW_PROFILE_OUTSIDE_HOME=1 is the explicit-consent escape hatch for Folder-Redirection setups; the ROCKY_TEST_POWERSHELL_HOSTS seam keeps its precedence.
• Error detail outside signal lines was unfindable for current-format records. v2 non-hook excerpts now feed recall's retrieval evidence under the same bounded token budget, so rocky recall "left-pad" finds npm ERR! No matching version found for left-pad@^99.0.0. Hook-origin and unproven legacy v1 excerpts stay excluded.
• Containment test fixtures now speak each platform's own path dialect; Windows-only semantics (drive letters, backslash normalization) skip on POSIX.

Full details: CHANGELOG.