- Perform non-blocking GitHub release check with 24-hour local caching (~/.agentic_ssh/version_cache.json).

- Print update notifications exclusively to stderr to preserve stdio/JSON streams.

- Add --no-update-check CLI flag and disable_update_check / no_update_check config settings.

- Document configuration options in README.md.

chore(deps): update rust crate serde_json to v1.0.151

chore(config): migrate Renovate config

- Implemented Dynamic Post-Execution Inspection Mode in watch command.
- Added Home/h, End/e, PageUp/PageDown, and mouse scroll layout support.
- Fixed scroll_offset integer underflow during log viewer navigation.
- Bounded log view scroll tracking using dynamic viewport measurements.
- Exposed list_groups in the MCP serve tools schemas.
- Added allow_hosts and ignore_hosts filtering to list_hosts.
- Documented host groups setup in README and agentic_ssh.toml.example.
- Bumped rust-version to 1.96 and updated crates dependencies.

Update Rust crate russh to v0.62.2

- Added [groups] table parser and validation to prevent name collisions with existing system SSH host aliases.
- Implemented recursive expansion and deduplication of group targets in parse_hosts.
- Added the built-in `list_groups` tool to expose active host group mappings.
- Updated MCP schemas to explicitly document group support in host/hosts inputs.
(closes #19)

Update Rust crate russh to 0.62

Update the release action from v4 to v7 and ensure the tap/Formula
directory exists before writing the homebrew formula file.

- Formalized "Agent-Friendly" tool description guidelines in README.md to eliminate tool drift and execution loops.
- Created root-level `agentic_ssh.toml.example` reference blueprint demonstrating parameterized tools ([tools.git_pull], [tools.check_service]) with strict input validation.
- Showcased high-blast-radius execution safeguards using explicit uppercase warnings and `allow_shell = false` containment configurations.

- Added secure, interactive human authentication check using /dev/tty to prevent automated agent sandbox self-authorization.
- Implemented cryptographic signature verification of local configurations via SHA-256 and a 0600-permissioned trusted_locks ledger in ~/.config/agentic_ssh/trusted_locks.
- Implemented recursive upward directory traversal to resolve project-specific .agentic_ssh.toml files.
- Added disable_local_config global kill-switch to enforce strict global sandbox.
- Implemented monotonic config merging to ensure untrusted local configs can only narrow/subtract capabilities (locking down shell access, parameters, and allowed hosts), whereas trusted configs can permissively expand them.
- Added Clap CLI subcommand 'trust' to register config files.
- Added unit tests verifying config traversal, trusted permissive merging, and untrusted subtractive merging.