v0.19.0

Changed

• Ship the checksummed Trackly Apply policy revision 4.8.0-kevin.1 across
  local and Cloud skill installations. Documented markHandoff() calls are
  checked against exact tab inventories and revalidated on later turns;
  completed calls are observations, never fabricated persistence receipts.
• Add agent setup --skills-only so Cloud and existing clients can install
  the same skill without changing MCP registration or authentication. Keep
  the numeric upstream skill version for protocol compatibility and report
  the policy revision separately.

Security

• Bump @modelcontextprotocol/sdk 1.30.0 to 1.32.1 (GHSA-6qxp-vccf-f47h, an
  OAuth-client issue; the local MCP server is stdio-only and uses no SDK OAuth
  client), proxy-addr 2.0.7 to 2.0.8 through Express's existing range
  (GHSA-jqcg-44mw-7w3h), and the dev-only sharp 0.35.4 to 0.35.5
  (GHSA-wq5f-xc86-pv6w), so npm audit is clean again.