Release v0.5.0 — security + honesty hardening · vkmtx/veil-mcp

Skeptic-review hardening pass — 10 merged PRs. Reproduce every number with npm run metrics.

🔴 Security

Checkpoint label .. no longer wipes the temp dir — safeLabel admitted ./..; a .. label made checkpoint() resolve to the temp root and rmSync it. Rejected + containedPath() containment at every join site.
git clean --force classified destructive (was read-only → no effect-tracking / nudge); a glob/redirect/$() no longer downgrades rm * / shred f > /dev/null / git reset --hard $(…) to complex.
Record store is owner-only (0700 dir / 0600 files) — captured stdout/stderr no longer world-readable on shared hosts.
Guard hook hardened — VEIL_BYPASS only as a leading env-assignment (no comment bypass); danger set covers find -delete, git clean -f/--force, chmod -R, shred, truncate, rm --recursive/--force; verb patterns anchored so benign arguments aren't mis-blocked.

veil init never deletes user content between mismatched markers.
Condensing surfaces more signal — the lexicon covers crash idioms (SIGSEGV, CONFLICT, ! [rejected], timed out, …) plus a +N more overflow note instead of a silent cap-at-5.
Snapshot honesty — method: "clone" is reported only within one volume; cross-volume / non-APFS falls back to rsync.
Falsifiable backtest floor — a per-short-command envelope-overhead check the byte-weighted net% structurally could not catch.

npm run metrics — agent-turns-saved (55% fewer round-trips), sandbox-escapes-blocked (5/5), signal-recall (100% on a labeled corpus), checkpoint cost (CoW clone vs rsync) — deterministic rows asserted in the suite so the figures can't drift.
"Why veil" + Metrics README sections; the over-claims a review flagged corrected to match what ships (lazy sandbox probe, guard = routing not containment, byte- not token-savings, 228 assertions).

Full detail: CHANGELOG.