docs: bump v0.2.0.7 → v0.2.1.0, update CLAUDE.md and changelog

README.md

@@ -2,7 +2,7 @@
 
 **Self-hosted update management for operators who own their stack.**
 
-`v0.2.0.7` — May 2026 · MIT License
+`v0.2.1.0` — May 2026 · MIT License
 
 > **NOT YET ANNOUNCED** — Tags do not imply stability. Massive flux. Use at your own risk.
 
@@ -217,6 +217,16 @@ Built for operators who'd rather own the problem than outsource it.
 
 ## Changelog
 
+**v0.2.1.0 (May 2026)**
+- Helper privilege split: `redflag-helper` now invoked via `sudo systemd-run --pipe` as its own transient service, escaping the agent's `ProtectSystem=strict` sandbox. The helper and its dnf/apt children see the real root filesystem.
+- Token-is-the-command: all package-manager operations now routed through one of two paths — discovery (scan, dry-run, hash-resolve) through a unified `DiscoveryRunner`, mutation (install, upgrade) exclusively through `consumer.go → systemd-run --pipe → redflag-helper`. The agent no longer has code to run `dnf install -y` or `apt install -y` directly.
+- `SecureCommandExecutor` deleted — replaced by `DiscoveryRunner` for discovery and the helper for mutation.
+- Sudoers narrowed: agent user can no longer run mutation commands (`dnf install *`, `apt install -y *`, etc.) — only discovery + the helper invocation.
+- `EcosystemConfig` registry: adding a new package ecosystem (AUR, Snap, Flatpak, Homebrew) means one config entry and implementing the discovery interface. Mutation is automatic via the token path.
+- Hash verification fail-closed: empty expected hash now returns an error instead of silently passing.
+- `Installer` interface shrunk from 7 methods to 4: `IsAvailable`, `GetPackageType`, `DryRun`, `VerifyHash`.
+- `apt-get` → `apt` throughout (ecosystem config, sudoers, discovery commands).
+
 **v0.2.0.7 (May 2026)**
 - Refresh-token rotation with accept-previous-once crash-recovery grace
 - Machine-bound renewal path closes stolen-config.json replay attack