v0.2.1

Makes apply --sign a required, explicit trust decision (local | github | none); adds a machine-readable mirror report + lockfile schema v2 and shallow-clone guards; ships a one-line installer and a Homebrew tap.

What's Changed

• release: emit combined SHA256SUMS; AGENTS.md: note --purpose snapshots by @redscaresu in #13
• feat(apply): required --sign mode (local | github | none) by @redscaresu in #16
• feat(mirror): guard --branch+shallow, machine-readable stdout (#15 B/D/E) by @redscaresu in #17
• feat(mirror): machine-readable report + lockfile schema v2 (#15 C) by @redscaresu in #18
• apply/docs: land verified --sign=local note, drop Non-goals, tighten README by @redscaresu in #19
• build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #1
• docs/install: one-line installer, Homebrew tap, agent-adoption snippet by @redscaresu in #20
• README: dedup auth/token story and agent framing by @redscaresu in #22
• homebrew: shorten formula desc under audit's 80-char limit by @redscaresu in #23

New Contributors

• @dependabot[bot] made their first contribution in #1

Full Changelog: v0.2.0...v0.2.1