feat: SLSA build provenance on release artifacts

chore: security hardening and dependency updates

feat: per-model burn rate command

fix: drop misleading 401 warning on account swap

fix: snapshot live creds into vault on swap and reconcile pass

feat: sync oauthAccount on claude account swap