Agent Pantry 0.6.0

Added

• agentpantry restore can materialize cookies from a sidecar backup into Netscape cookies.txt, a Chromium profile cookie DB, or a running loopback Chrome DevTools target with --to cdp=http://127.0.0.1:PORT. CDP restore writes through Storage.setCookies, skips expired cookies with a safe count, and supports --verify readback with per-domain expected vs present counts and cookie names only. Cookie values never appear in any output, including CDP protocol errors.
• Source configs can set peer = "none" for local script-driven deployments: doctor skips peer reachability and reports the local topology as OK, while the long-running source loop rejects the sentinel and sink configs still fail validation.
• agentpantry source --once runs the startup sync path once over TCP or --stdio, persists source state, then exits 0 on success without starting the watcher or resync timer.
• Source-side KeePass secret reader: keepass_path/keepass_keyfile/keepass_pass_file/keepass_tag read tagged vault entries as named secrets, replacing the need for a plaintext secrets_dir. agentpantry doctor validates the unlock and reports the tagged entry count.
• make install builds a version-stamped binary into $(PREFIX)/bin (default ~/.local/bin), and scripts/cut-release.sh vX.Y.Z cuts a release end to end: verify, tag, push, wait for the published release, install the live binary, and confirm the running version matches the tag.

Security

• Bumped the Go toolchain to 1.25.12, resolving GO-2026-5856 in the crypto/tls standard library flagged by govulncheck.