v0.3.0

Changed

• /run now holds back a few destructive commands. A recursive
  force delete aimed at / or $HOME, a fork bomb, mkfs, dd to a
  raw device. They come back naming what they do, and one tap sends
  anyway.
• Nothing else is affected: rm -rf /tmp/build, cat .env and
  git push --force go straight through. A seatbelt against the wrong
  tab number, not a filter — bash -c 'rm -rf ~' is not caught.

Added

• Optional passphrase for those commands, instead of a tap.
  agents_control passphrase set|clear|status, offered during setup
  and from the bot itself.
  • PBKDF2-HMAC-SHA256, 210k iterations, salted; Keychain or libsecret;
    never argv.
  • The message carrying it is deleted from the chat once read.
  • Set from the chat, it guards against whoever reaches that chat
    later, not whoever has it now.
• Files can be sent to a session — photos, video, voice, documents.
  • Saved to ~/.local/state/agents_control/inbox/; the pane gets the
    local path, never a link (the download URL contains the bot token).
  • Target: caption /run N …, or reply with the file to a session's
    message. Otherwise the path just comes back in the chat.
  • Kept telegram.inbox_keep_days (14), then swept.
• /status, /settings and doctor report whether a passphrase is set.

Fixed

• No panes were listed on tmux 3.5 — Debian 13's and Ubuntu
  24.10's. It prints the record separators as octal escapes where 3.7
  emits the bytes, so the parse found nothing and /tabs came back
  empty with no error.
• The startup hook check probed whichever hook was listed first —
  ours only until you have a Stop hook of your own. It replayed that
  entry's headers to its URL without TLS, sending a third party's
  bearer token in cleartext once per daemon start. Found by its marker
  now, and only probed on loopback.

Internal

• The suite runs on Linux (554 tests, both platforms). It was green on
  macOS and 88 failures deep on Linux, which is how the tmux bug above
  survived a release.
• The suite fails if a test is written where Minitest won't collect it.