Release v0.11.1

Improvements

auth config mode. A new per-repo auth field in .awman/config.json controls how credentials reach agent containers. keychain (default) keeps the existing behavior; passthrough and none disable host keychain injection for harnesses that supply credentials another way, while declared env() overlays still apply. See Control credential injection.

Credentials are deduplicated at injection time: when a repo declares env(ANTHROPIC_API_KEY) (or another credential covering the same provider) and that variable is set on the host, the keychain OAuth token for that provider is no longer also injected. If the declared passthrough var isn't set on the host, the keychain credential is retained so the container isn't left without any credential for that provider.
Fixed a spurious sandbox error when an sbx child process exits before reading its piped stdin (e.g. a secret set call that bails with "not logged in" without consuming the secret). The resulting BrokenPipe is no longer surfaced as the failure — the child's actual exit code and stderr are reported instead.

curl -s https://prettysmart.dev/install/awman.sh | sh
awman ready

No config migration is required. The new auth field is optional and defaults to the existing keychain behavior.