slb v0.4.0 — security release

Security: unmatched commands can no longer skip the two-person rule (#9)

Previously, a command that matched no classification pattern was executed
immediately as safe-tier. Interpreter wrappers (python -c ..., bash -c ...)
and other unmatched invocations therefore bypassed the two-person rule entirely.

• Fail closed (004bb40): unmatched commands now escalate to the
  dangerous tier and require approval instead of executing as safe.
• Compound-segment hardening (2fb23f3): in compound commands
  (a && b, a; b, pipelines), a safe segment can no longer launder an
  unmatched segment past approval — every segment must independently clear
  classification, and the strictest tier wins.

Credit: reported by @nskidan — thank you for the report.

If you rely on unmatched commands running without approval, add explicit
safe-tier patterns for them; the default is now conservative.

Fixes since v0.3.1

• #8: slb CLI no longer swallows every command error into a bare exit 1
  — real error text and exit codes propagate.
• #7: custom patterns are loaded on the execute/request/run classification
  paths; nil Classification guarded on the skipped-request path; subcommand
  shorthands that collided with root persistent flags removed.
• #2 follow-ons: patterns add persists to SQLite and reloads on read;
  daemon and hook paths merge custom_patterns at startup / before
  generate/install/test/status; version output includes persisted customs.
• #3: daemon/hook socket path hashes the project root, not the CWD.
• #4/#5: hook emits the Claude Code 2026.04 JSON shape and preserves regex.