v0.12.0

Added

• ls labels its columns, and --sort orders the rows. (#179) The table
  printed up to eight columns and said what none of them were, so every reading
  of it started by counting cells against the README — and the listing is
  watched on a refresh loop, where that cost is paid again every time. A label
  row is now drawn by default; --no-header leaves it out for anything parsing
  the table by line. --sort takes status, seq or branch. status ranks
  by how much the row wants a person — blocked, idle, done, working, then the
  worktrees with no agent — rather than alphabetically, and seq is lowest
  first, because the counter only ever answers which worker herdr saw move
  longest ago. Ties keep git's order, no --sort keeps it entirely, and the
  order applies to --json as well as the table.

• scripts/install.sh — worktender without herdr and without Go. (#144)
  The degraded path #143 built never fired on the only install route that
  existed: herdr plugin install means herdr is present by definition. One
  documented step now puts the binary on PATH for someone who runs neither:

  curl -fsSL https://raw.githubusercontent.com/steig/worktender/main/scripts/install.sh | sh

  It follows releases/latest to a tag and pins both the binary and the
  checksums.txt to that one release, verifies the SHA-256 before making
  anything executable, and fails closed — a missing checksum line is as fatal as
  a mismatched one, and every failure path removes the staged download. Nothing
  is ever written to the destination path unverified, and it never wants sudo.
  --version pins a release, --dir moves the destination off ~/.local/bin.
  See Trust for what the checksum does
  and does not prove.

Changed

• The release workflow stamps the version into the binary. (#144) A plugin
  install reads its version out of the manifest beside it and a standalone
  install has no manifest at all, so without this doctor could not name the
  release it was — half of what that command is for.
• update and doctor answer for a standalone install. (#144) update
  moves a plugin checkout forward and a standalone install has none, so it
  names the one step that does — re-running the installer — rather than
  reporting a missing herdr-plugin.toml. It deliberately does not run that
  itself. doctor's version line reports the release and says plainly that
  nothing compared it against the newest. A binary that is neither — a hand
  go build — is still told what was looked for.
• Resolving the binary is PATH-first everywhere it is documented. (#144)
  herdr plugin list --json is not available to a standalone install, so the
  README, both skills, docs/dispatch.md and docs/json.md now take what is on
  PATH and fall back to the plugin root. doctor says on PATH already when
  typing worktender reaches the binary printing the line.

Fixed

• A pushed tag now reliably gets a release carrying the build assets.
  (#182) release.yml's publish step ran gh release create, which is
  fatal when a release already exists for the tag — and one usually does,
  because the release object with hand-written notes is created from a
  laptop, which is also what pushes the tag. Every release from v0.10.0
  through v0.11.2 built and checksummed fine and then failed to publish with
  a release with the same tag name already exists, shipping with zero
  assets attached. Nothing downstream said so: scripts/install.sh and
  scripts/build.sh's no-Go fallback just 404 on
  releases/download/v<version>/worktender_<os>_<arch>. The step now goes
  through scripts/release-publish.sh, which creates a release only when the
  tag has none and always ends in gh release upload --clobber, leaving
  notes already on an existing release untouched. Losing the create to
  something else — two runs of the workflow for one tag — is not fatal
  either; whoever won made the release this run still has to upload to. And
  the assets are checked to be real files first, because release.yml
  passes an unquoted dist/* and an empty dist/ would otherwise publish
  the literal glob.