0.24.0

Added

• Compared with other tools: drive next to gog, Workspace MCP and rclone, with where each
  fits better, and when Google Docs' own Markdown editing is enough.
• Roadmap: what is planned for drive and is not in it yet.

Changed — may break callers

• The profile is only the first word, or DRIVE_PROFILE; --profile is gone. drive --profile work … now fails
  with a pointer to drive work …. DRIVE_PROFILE names the profile when the command line does not.
• A profile that does not exist is validation_error (exit 2) with the profiles here (profile.unknown,
  details.profiles), not authentication_error (exit 4) with a hint to sign in under the misspelled name.

Fixed

• A partial sync or mirrors sync says so in its answer. meta.complete is false with one issues entry per
  failed source, where it used to say true before the command failed.
• DRIVE_READ_ONLY refuses config set. A setting changes what later runs may do; it was the one local write the
  lock let through.
• Output piped into a reader that stops early ends quietly. drive commands --json | head exits 0 instead of
  printing a stack trace.
• DRIVE_PROFILE_LOCK pins the process. A first word or DRIVE_PROFILE naming another profile is refused with
  permission_error; with no profile named, the locked one is used. Before, the variable was ignored.
• session list and config show run without a profile, as they read every profile. A missing profile's error
  names a leftover default_profile instead of ignoring it silently.

Security

• --permission can no longer loosen a profile's settings. A level looser than the profile's, its defaults or a
  built-in default (such as ask before a deletion) is refused with validation_error; before, --permission api=allow lifted a deny, also for the MCP server it started. A flag still tightens. A permission in the config
  or on the command line that names no drive command is refused, not ignored, so a misspelling cannot silently
  allow more.