askalf/truecopy

own your agent skills — vet, sign & pin every skill & MCP server before it runs, then fail the build when the bytes change.