Revise README for improved clarity and structure

Brings ai-authorship note above the fold, and adds a note about imperfect isolation guarantee.

Signed-off-by: bdeshi <bdeshi@bdeshi.space>

.github/workflows/release.yml

@@ -28,7 +28,7 @@ jobs:
       # below treats as "fall back to ad-hoc".
       SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.tag || github.ref }}
 
@@ -139,7 +139,7 @@ jobs:
         run: ditto -c -k --sequesterRsrc --keepParent ".build/shannoncoat.app" "shannoncoat.app.zip"
 
       - name: Publish release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ inputs.tag || github.ref_name }}
           files: |

.github/workflows/tag-on-version-bump.yml

@@ -15,7 +15,7 @@ jobs:
       tag: ${{ steps.tag.outputs.tag }}
       created: ${{ steps.tag.outputs.created }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -45,5 +45,11 @@ jobs:
     uses: ./.github/workflows/release.yml
     with:
       tag: ${{ needs.tag.outputs.tag }}
+    # A called workflow gets no secrets unless they're handed over, so
+    # without this the signing secrets are empty inside release.yml and it
+    # quietly builds ad-hoc — which is exactly what signing exists to
+    # prevent, and which its own ad-hoc guard misses, since that guard only
+    # fires when an identity was configured.
+    secrets: inherit
     permissions:
       contents: write

README.md

@@ -1,14 +1,20 @@
 ![shannoncoat — which coat will Claude wear today?](docs/hero.png)
 
-Run multiple isolated Claude profiles on macOS — each one its own Claude Desktop
-**and** its own paired Claude Code setup — and tell their windows apart at a
-glance.
+Run multiple isolated [**\***](#isolation) Claude profiles on macOS — each one
+its own Claude Desktop **and** its own paired Claude Code setup — and tell their
+windows apart at a glance.
 
-Your normal Claude install is left completely alone. It stays exactly as it is
-and keeps working normally; shannoncoat only adds profiles alongside it.
+Your normal Claude install is left alone. It stays as it is and keeps working
+normally; shannoncoat only adds profiles alongside it.
 
 A menu-bar item allows quick switching and profile management.
 
+---
+> [!NOTE]
+> shannoncoat started as the shell script in the first commit, written by hand.
+Claude built the GUI app out of it — most of the Swift, the icon, and this
+README — working from human direction, review, and dogfooding.
+
 ## Requirements
 
 - macOS 13 or later
@@ -115,8 +121,12 @@ rather than killing Claude underneath it. Answer the dialog.
 
 ## Build from source
 
-Requires the Xcode Command Line Tools.
+Local builds require the Xcode Command Line Tools.
+```
+xcode-select --install
+```
 
+Then run the build script
 ```bash
 ./build.sh
 ```
@@ -129,8 +139,12 @@ every time, which silently invalidates its Accessibility grant on each rebuild.
 `.env.example` walks through creating a self-signed certificate once so the
 permission survives.
 
----
+## Isolation
 
-shannoncoat started as the shell script in the first commit, written by hand.
-Claude Code built the app out of it — most of the Swift, the icon, and this
-README — working from direction, review and testing.
+> [!IMPORTANT]
+> Perfect isolation is not guaranteed. Claude and Claude Code can have functionally
+> full disk access regardless of which profile it's running from, including access
+> to default configuration folders.
+> 
+> Some Claude integrations — skills, plugins, etc — may also hardcode the
+> `~/.claude` path which may modify content in there.

VERSION

@@ -1 +1 @@
-0.0.9
+1.0.0