agent-paste CLI cli-v0.1.9

What's changed

• chore(cli): bump version to 0.1.9 (#579)
• Apex demo prompt, claim-code docs, and CSP-safe support link (#578)
• refactor: break runtime import cycles, promote no-circular to error (#565)
• test: add StrykerJS mutation-testing pilot for high-value packages (#563)
• fix(mcp): widen idempotency args hash to 128-bit to stop silent edit replay (#560)
• Track claim-code activation funnel events (#556)
• feat(apex): unlisted-first ephemeral docs + combined prompt-copy funnel (#552)
• fix(ephemeral): return unlisted publish URL (#549)
• fix(content): allow Tailwind CDN in CSP
• docs(mcp): clarify agent publish recovery flow (#542)

Standalone CLI binaries cross-compiled with bun build --compile. macOS binary is codesigned + notarized. Each binary carries a GitHub build-provenance attestation (verify: gh attestation verify <binary> --repo zaks-io/agent-paste) and an attached SLSA provenance sidecar (*.intoto.jsonl). A CycloneDX SBOM of exactly what is compiled into the binary (agent-paste-cli.sbom.cdx.json), a blocking grype scan report (agent-paste-cli.grype.json), scanner/DB versions (scan-metadata.json), and repo security attestation bundle (repo-security-attestation.tgz) are attached. Draft - review and publish manually. Verify downloads against SHA256SUMS.