immybot-v0.1.3

Fixed

• recall and playbook list no longer claim to be read-only. Both open the writable
  learn store and record a row, but were annotated mcp:read-only=true - and that annotation
  is what an MCP host reads to decide what to auto-approve without asking you. They are now
  mcp:local-write, a tier this engine already defines and already uses for teach: writes
  land only in the CLI's own local store, never in external state and never in a user-visible
  file. Measured at the live MCP server, both tools moved from readOnlyHint=true, openWorldHint=true to readOnlyHint=false, destructiveHint=false, openWorldHint=false.
  No behaviour changed - both commands write exactly what they wrote before. The promise was
  the defect, not the write.

Added

• IMMYBOT_NO_CONFIG_WRITE=1 keeps every credential off disk. Set it and the CLI mints a token per
  invocation instead of caching one in config.toml. The MCP server honours the same switch,
  which it previously could not: it resolved its own config path and ignored --config
  entirely, so a Claude Desktop setup kept a plaintext token cache even when the CLI had been
  told not to write one. auth logout still clears a config that already exists - the switch
  suppresses credential writes, not the erase.

Changed

• Install and remote-agent documentation corrected against the shipped binaries. The remote
  section named mcp-remote, which bridges the opposite direction and cannot publish a local
  stdio server at all; connectors that parse --transport http now point at the native flag
  and the rest at supergateway. The HTTP endpoint is /mcp, not the bare root the docs gave.
  The Windows install path and a fallback paragraph describing an npx install that is not
  offered were both wrong and are gone. A new check_install_docs gate holds these claims
  against the binaries and installers so they cannot drift again.