m8m 0.4.0

What's new in 0.4.0

CLI output redesign

• m8m scan — per-provider entry counts, an "Analyzing sensitivity" section with ▲ findings (masked secrets → file:line), and a severity meter.
• m8m audit — one combined provenance view (entries, oldest/newest, provider summary, colored category bars) plus security findings.
• m8m watch — shows direct MCP memory writes (stored/updated/deleted) alongside file changes, prints - for removed lines, and flags only the edited content (not the whole file). No emoji; secrets masked.

Fixes

• MCP platform detection reads clientInfo.name after the handshake (was read too early); dsh no longer loses to claude.
• npm install -g . no longer rebuilds as root, so it can't leave dist/ root-owned.

New

• DeepSeek Harness provider (~/.dsh/cordis.patch.yml, settings.yaml).
• Analyzer splits credential findings per secret (API keys critical, AWS keys HIGH) and treats emails as HIGH.

Tests

• 145 tests passing, including new coverage for scan/audit/watch output.