This release adds comprehensive workflow testing and sandbox policy features:

Workflow Test Mode (`localmost test`):
- Run workflows locally before pushing to catch issues faster
- Intercepts actions/checkout to use local working tree
- Intercepts actions/cache for local caching
- Stubs upload/download-artifact actions
- Matrix support (--full-matrix, --matrix flags)
- Environment diff reporting (--env flag)

Declarative Sandbox Policy (.localmostrc):
- Per-repo policy files declaring allowed network/filesystem access
- Default-deny sandbox enforced at runtime
- Per-workflow policy overrides
- Discovery mode (--updaterc) generates policies from observed access
- Policy validation with `localmost policy validate`

Secrets Management:
- Secure storage in macOS Keychain
- CLI commands: secrets set/get/delete/list/clear
- Per-repository scoping

Environment Comparison:
- `localmost env` shows local tooling versions
- Compare against GitHub runner environments
- Suggestions for pinning versions in workflows

Background Runner Integration:
- Policy cache per repository
- Requires approval when .localmostrc changes
- Diff display for policy modifications

New shared modules in src/shared/:
- workflow-parser.ts: Parse GitHub Actions YAML
- step-executor.ts: Execute workflow steps with sandbox
- sandbox-profile.ts: Generate macOS sandbox-exec profiles
- localmostrc.ts: Parse and validate policy files
- action-fetcher.ts: Download and cache actions
- workspace.ts: Create temp workspaces for test runs
- secrets.ts: Keychain-based secret storage
- environment.ts: Detect and compare environments

New CLI commands:
- localmost test: Run workflows locally
- localmost secrets: Manage workflow secrets
- localmost policy: Manage .localmostrc policies
- localmost env: Show environment info