v0.2.2 — install hardening (atomic self-updater, --version)

Reliability release: fixes a recurring install bug where brew safe-upgrade could fail closed with bottle SHA resolver not found after an update.

Fixed

• Self-updater no longer strands helper files. A brew safe-update from an older updater could fetch only some files yet print "All tools updated", leaving bottle_resolver.py / cask_nvd_map.py missing — so the next brew safe-upgrade failed closed. The updater now re-execs the freshly-fetched updater before the download loop and is atomic + fail-closed: it swaps files into place only if every declared file arrives intact, and never reports success on a partial set.
• Scripts resolve their own directory through symlinks (portable, no macOS-hostile readlink -f), so helpers resolve for script, Homebrew-formula, and symlinked layouts on both architectures.
• A missing helper now prints actionable guidance (run 'brew safe-update').

Added

• --version on all three commands, with self-diagnosis: prints the version, the detected install route (formula vs script), whether every helper file is present, and a warning if both install routes are on PATH.

Verified

• Real install-and-run dogfood on Intel and Apple Silicon Macs (script route) + macOS arm64 and x86_64-Linux CI.

Update: tap users brew update && brew upgrade safe-upgrade; script users brew safe-update.

Full changelog: v0.2.1...v0.2.2