v0.2.3 — security hardening

[0.2.3] Security hardening (supply chain + token hygiene)

Security

• Supply chain: pinned mcp-publisher to v1.6.0 + SHA256 verify (2de4ac3b...405d42). Previously piped releases/latest straight through tar xz, running any upstream-compromised binary inside a workflow with OIDC + NPM_TOKEN in scope.
• Supply chain: npm publish --provenance + post-publish attestation gate. Older releases claimed provenance but npm view trackly-cli@0.2.2 dist.attestations was empty — docs shipped ahead of reality. Workflow now fails the release if the attestation doesn't land on npm.
• Dependency CVEs closed. hono@4.12.14 + @hono/node-server@1.19.14 (GHSA-92pp-h63x-v22m, GHSA-26pp-8wgv-hjvm). npm audit clean.
• Atomic config write in lib/client.js — a crash mid-write no longer truncates ~/.trackly/config.json.
• Surgical refresh-token cleanup (clearOAuthTokens): an invalidated OAuth session clears only token + refreshToken, preserving user-configured baseUrl / apiKey / other settings.
• --api-key CLI flag now warns on stderr (silenceable with TRACKLY_NO_WARN=1) and scrubs process.argv[i] to *** so diagnostics/child processes can't recover the secret. The ps vector is still open — prefer TRACKLY_API_KEY env var or trackly config --api-key.
• HTTP statusCode preservation — apiRequest rejections now put the HTTP status AFTER the body spread so a server body like {"status":"error"} can't clobber the numeric code and silently break downstream branches.

Infra

• 27/27 tests pass (added 6 new: apiRequest spread-order guard, refresh-clear on 401/2xx-tokenless/network-error branches, clearOAuthTokens file-unlink behavior).
• Publish workflow no longer pre-flights npm view under pipefail — transient registry flakiness no longer false-fails releases. Already-published detection now reads the actual signal from npm publish's error output.