v0.5.4

[0.5.4] - 2026-03-30

Added

• add 40+ tests: edit parse/diff, error display, vault lock/write, env symlink/perms, tarpaulin binary coverage
• add github key parsing tests, Debug for MurkRecipient, cache tarpaulin/audit installs
• add merge, recovery, info, env tests; fix duplicate test names; total 383 tests
• add 20 adversarial tests: malformed vaults, symlink attacks, permission checks, tampered integrity, hostile imports, merge driver abuse
• add TOFU pinning for github:username key fetch

Changed

• extract scan logic to lib, add scan unit tests, fix npm publish lifecycle scripts
• extract edit parse/diff logic to lib, configure tarpaulin for binary coverage
• bump to v0.5.4

Fixed

• fix npm publish: skip lifecycle scripts during ci, add GITHUB_TOKEN for napi
• fix tarpaulin: use --run-types Tests (Bins is not a valid option)

Other

• switch from tarpaulin to cargo-llvm-cov for binary + library coverage
• expand adversarial tests: invalid keys, edge cases, revoke/authorize abuse, import collisions (31 total)