v0.0.16 — HA receiver profile-secret scoping
- Under multiplexed Hermes, receiver registration without an existing secret scope now binds the owning profile's credentials before its event-loop thread starts.
/health, WebSocket authentication and Assist callbacks use the correct profile token. - Existing scopes remain intact; missing profile homes fail closed. Regression coverage exercises both behaviours.
- Package, HACS integration, add-on scaffold and Hermes plugin versions are aligned at 0.0.16.
Issue #49: This addresses the unscoped receiver path. Reconnect-after-gateway-restart is still under investigation; the issue remains open.
Python 3.11/3.12 tag CI passed, including release integrity and package build. The attached wheel contains the Hermes plugins; the source distribution contains the full HACS/add-on bundle.