pgman v0.4.0

Added

• Masked dumps: pgman dump --masked, the default for a protected
  environment, takes a copy with what looks personal replaced as it is
  read — emails, names, phones, postcodes, dates of birth, IPs and
  passwords by realistic fakes, secrets, special-category data,
  identifiers, addresses and free text removed — judged from each
  column's name and type, with framework presets (Flyway, Liquibase,
  Envers, Spring Session). Foreign keys keep joining; a fresh key per
  copy, never sent to the server. One snapshot, a .pgman-dump
  directory with checksums, which pgman restore loads rows-then-keys.

• .pgman/masking/<database>.toml: the team's own rules (keep with a
  reason, fixed, hash, email, name, phone, ip, postcode, year,
  date.shift, rows dropped), and pgman masking show / check to see
  and test them from the catalog alone, in CI too.

• docs/privacy.md: what pgman does with personal data, for a client's
  DPO.

• pgman copies: every dump taken on this machine, from a journal
  pgman now keeps (~/.local/share/pgman/journal.jsonl): when, of what,
  raw or schema, why, the file, when it expires, where it was restored.
  copies show gives one in full, copies rm deletes one (and repoints
  its -latest link), copies report prints the whole account as text,
  markdown or JSON. No data, connection details or secrets are recorded.

• A dump policy per environment in environments.toml: dump
  (unmasked, masked, schema, never), dump_ttl, dump_reason
  and unattended. A project's .pgman/pgman.toml can lower an
  environment's ([dumps.environments.<name>] dump = "schema"), never
  raise it.

• journal = { group = "/pgman/dumps" } on an environment sends the
  journal's events for its copies to that CloudWatch Logs group with the
  aws CLI, as the IAM identity that sent them: file names without
  paths, no server addresses. A send that fails never fails the dump and
  is retried by the next pgman dump or pgman copies; each event is
  sent once.

• pgman dump --schema-only, --reason and --ticket. The reason
  prompt offers the ticket in the branch's name (feature/APP-101-…),
  else the last reason given; [dumps] ticket_url links tickets in
  pgman copies.

Changed

• A dump of a protected environment asks why it is taken, and a raw
  dump of one (every row) also takes the environment's name typed,
  after a warning that it copies personal data to this machine. Without
  a terminal, a raw dump of a protected environment is refused unless
  the environment says unattended = true in your own
  environments.toml; scripts that need only the structure use
  --schema-only --reason …. Other environments are dumped as before.
• A protected environment is dumped masked by default; a raw copy of
  one needs dump = "unmasked" on it in your own environments.toml,
  --unmasked, and its name typed at a terminal.
• A dump with no FILE goes to ~/.local/share/pgman/dumps rather than
  the current directory. A raw dump of a protected environment is
  refused in iCloud Drive, Dropbox, OneDrive or Google Drive; every dump
  is excluded from Time Machine.
• pgman copies rm also drops the databases restored from a copy (only
  local, unprotected ones whose comment names it).
• MCP's dump takes a protected environment masked (or schema only),
  using a rules file only when it is committed and you have confirmed it
  at a terminal; a raw dump of one over MCP, which v0.3 allowed after its
  name was typed, is refused, and every MCP tool refuses a database
  restored from one. The reason is given by you in the confirmation.
  Each MCP dump and restore is journaled.
• environments.toml has new keys (dump, dump_ttl, dump_reason,
  unattended): an older pgman reading a file that uses them refuses
  it as unknown keys.
• MCP's restore takes a masked dump, or a dump this machine's pgman
  took; a dump the journal doesn't know, or a raw copy of a protected
  environment (copied or moved too: each dump's fingerprint is
  recorded), is refused, yours to restore at a terminal.
• A restore that fails part-way is journaled, and the database it made
  is marked as the copy's from the moment it exists.
• A dump of a database restored from a raw copy of a protected
  environment is treated as a dump of that environment.

Fixed

• pgman … | head (any command whose reader goes away early) ends
  quietly instead of aborting.
• pgman restore into a protected environment of replicas only says it
  is protected, not to name or add its primary.