v0.22.0

Read-only profile resolution (safe on read-only mounts and headless servers) and the Workspace refactor; corrupt token stores now fail loudly.

Breaking

• Unknown or stale profile names fail launches loudly. Launching with a profile that no longer exists raises a clear error instead of silently falling back to ~/.claude; profile locations are derived from the profile directory, never from persisted metadata.

Features

• Health detects relocated workspace roots. A new health check flags profile hook commands pointing at a different scripts directory than the current workspace; patch-profiles fixes them.

Fixes

• resolve_profile no longer writes. Profile resolution performs zero filesystem writes and no terminal queries — safe on read-only mounts and headless servers.
• migrate now supports the default profile. Session data can be migrated to and from the ~/.claude default profile; previously it errored as if the profile did not exist.
• options.json no longer stores profile locations. A one-time migration removes the legacy profile metadata block; profile locations are always derived from the profile directory.