MarchyBar 1.0.2 — Security release

Security update for the privileged device broker.

• Authenticate SO_PEERCRED peers against an active local logind session before reading requests.
• Cap concurrent handlers and the accept backlog at eight; reject excess connections immediately and return slots after failures or disconnects.
• Preserve per-operation authorization, inactive-owner release, and cleanup. Add idle-connection and slot-reuse regressions.
• Synchronize release versions at 1.0.2; the system package is marchybar-system-1.0.2-1.

Upgrade: have the administrator install the matching reviewed system package, then run Set up Touch Bar again. Updating the plugin alone does not replace the installed privileged helper.

Validation: version checks, native build and Node tests passed on Node 22 and 24; all 55 Python security/setup tests passed on GitHub Actions.

Release commit: e7294e3. Marketplace verification of this exact release commit will be requested separately; approval of 3fdd614 does not transfer automatically.