v0.2.0

Changelog

• 1c1e6e5 chore: remove the internal workspace project note
• 832cd69 docs(changelog): record the 0.2.0 release
• f5d7d3a docs(readme): document observe-first flow and the kill gates
• 1dcbad2 feat(cli): add system hygiene audit
• ef3c283 fix(config): add user blocklist to built-ins instead of replacing them
• e691546 fix(config): default to observe-only instead of killing
• 6bb286f fix(hygiene): check every user LaunchAgent instead of a hardcoded label list
• 85267f2 fix(killer): verify full identity and re-check conditions before killing
• 4115f69 fix(patterns): anchor the mcp token and detect terminal-launched agents
• fb71689 fix(scanner): cancel port scans on timeout
• f13bc90 fix(scanner): require a strong lifecycle signal before a process is killable
• 804ee0b fix(scanner): treat unreadable process metadata as unknown, not as evidence
• da6dc74 fix(scorer): stop treating a listening port as kill evidence
• 0bec4fb fix: pin golangci-lint v2.4 for Go 1.25 compatibility
• e0da2af fix: production hardening step 2 — lint config, docs, and build fixes
• ffd4035 test(cli): isolate live daemon state
• 12a3dbf test(patterns): use a neutral home path in match fixtures