cloak 0.1.0

Linux bundles built from a3a9cab by run https://github.com/twostack/cloak-cli/actions/runs/36080803420; the macOS disk image is built, signed and notarized separately and added to this draft. Check a download with shasum -a 256 -c SHA256SUMS --ignore-missing, a Linux bundle with gh attestation verify <bundle> --repo twostack/cloak-cli, and the disk image with spctl --assess --type open --context context:primary-signature -v <image>.