v0.23.1

Patch release fixing all five open issues reported from consumer repos (Codex + Python installs).

Fixed

• #46 — upgrade deadlock: rerunning upgrade --apply at the current version now detects and merges pending sidecars from earlier runs. Hook files are merged structurally (user entries preserved) and propagated into .claude/settings.json#hooks; non-mergeable files require per-file confirmation with a backup kept next to the sidecar. upgrade --plan, doctor, and hook-integrity failures all point at pending sidecars now.
• #45 — consumer version false-fail: check-runtime-surface no longer compares the installed kit version against the consumer app's package.json version.
• #47 — Python readiness gate: init emits a per-language structural gate (python3 .harness/runners/structural_test.py for Python, go run … for Go, node … for Rust/Swift/Kotlin); upgrade repairs stale kit-generated gates in existing installs.
• #44 — Codex advisor proof: generated AGENTS.md states that node .harness/scripts/codex-advisor-run.mjs --task <taskId> is the only supported advisor path on Codex (no native agent_type=advisor); check-runtime-surface requires the bridge on the codex surface when the advisor is enabled.
• #50 — Codex multi-agent tool permissions: task-evidence-check and the PreToolUse guard now agree on canonicalizing multi_agent_v1* aliases onto the Task permission class; contracts may declare "Task" or the raw alias, and denial messages explain the mapping.

Full notes in CHANGELOG.md. No schema changes.