v0.2.11

What's Changed

• Hardened the update helper: The script Parakey writes to relaunch
  after a Homebrew upgrade now lives in the per-user temporary directory
  with mode 0600, not in /tmp with a brief world-readable window.
  No user-facing behaviour change; closes a local file-permission gap.
• Refuses sync through symlinks: The text-corrections sync file is
  now checked with lstat before every periodic read and write. If the
  configured path is a symbolic link, Parakey shows a "Sync Failed"
  alert and stops syncing instead of following the link. Protects
  against another local process planting a symlink at the persisted
  sync path.
• Refuses to launch under a tampered model-download environment: If
  REGISTRY_URL or MODEL_REGISTRY_URL is set in Parakey's process
  environment, Parakey now exits with a blocking alert pointing you at
  ~/Library/LaunchAgents/, your shell rc files, and any parent
  process. FluidAudio uses those variables to redirect the speech-model
  download base URL, and Parakey does not document either as a feature.
• Setup Checklist polish: Permission descriptions now name the
  exact System Settings breadcrumb and the control to flip. The
  TCC-reset tip explains the "Try Again" step explicitly, including the
  "doesn't appear in Settings" case. Checklist rows, separators, and
  the footer now share a single content width so the Status / Grant
  column no longer drifts between rows.
• Documented the speech-model trust model: SECURITY.md now spells
  out how the Parakeet TDT v3 weights reach the user (HTTPS from
  Hugging Face via FluidAudio, no cryptographic integrity check on the
  payload) and what the realistic abuse channel looks like.
• Enabled Dependabot: Weekly PRs for the single Swift dependency
  (FluidAudio) and the GitHub Actions used in .github/workflows/.
  Repo-side hygiene; no app-side change.