v0.44.0

Safety denylist (config.forbid): declare selectors/URLs a plan must never touch, and a run that targets a forbidden selector or reaches a forbidden URL aborts with a 'forbidden' failure — the CI guardrail against irreversible side effects (changing the test password, deleting data, saving config). Author-declared; the engine never infers it. A forbidden block doesn't invalidate the cache or re-plan, so it needs no LLM key.