release: 0.1.9, with a bun that runs without AVX2HEADmain

The tarball shipped bun's default x64 build, which requires AVX2 -- so sl0ppi
installed cleanly on a plain KVM guest and then died with "Illegal instruction"
the first time anything ran pi. Known since 0.1.7 and carried as an open item;
not something to ship a third time.

packaging/fetch-vendor.sh now fetches bun-linux-x64-baseline.zip. Verified
without needing such a machine, on an emulated CPU that has none:

  qemu-x86_64 -cpu Nehalem <baseline>/bun --version   ->  1.3.14
  qemu-x86_64 -cpu Nehalem <default>/bun  --version   ->  Illegal instruction

Also drops the installer's closing note about the status bar asking for
permissions on first launch: shipped plugins are granted implicitly now, so the
prompt it told people to expect no longer appears. (That text is baked into the
0.1.9 tarball; it is wrong but harmless, and corrected for the next one.)

And gitignores *.core -- qemu writes one where you stand when it kills a target
on an illegal instruction, and a 100MB core dump nearly went into this commit.

0.1.9 contains everything since 0.1.8: the split button actually visible and
clickable where it is drawn, including on stacked panes; shipped plugins not
asking for permission; the status bar as a framed box in the pane style with a
new-tab button and margins matching the pane gap, collapsing to a single line
in the mobile layout; and runtime tabs keeping a status bar without losing the
purpose the CLI uses for identity.

2 files changed, 25 insertions, 6 deletions

diff --git a/docs/HANDOVER.md b/docs/HANDOVER.md
index 1e3fe96..eb0e467 100644
--- a/docs/HANDOVER.md
+++ b/docs/HANDOVER.md
@@ -107,7 +107,7 @@ directory rather than to widen the rule.
 ## Where the project is
 
 Everything is committed and pushed to `ssh://git@git.sl0p.foo:39327/srv/git/sl0ppi.git`.
-Released artifacts are at <https://sl0ppi.sl0p.foo> (currently 0.1.8).
+Released artifacts are at <https://sl0ppi.sl0p.foo> (currently 0.1.9).
 
 | phase | state |
 |---|---|
@@ -134,13 +134,11 @@ URL afterwards.
    `ScreenInstruction::RemoveClient` on a debug build to find where it is lost.
    Cheap alternative: give the headless path its own pty (`script -qec`) and
    kill the client afterwards — killed clients demonstrably do not leak.
-2. **bun is the AVX2 build.** Caused `Illegal instruction` on a plain KVM guest.
-   One line in `packaging/fetch-vendor.sh`: `bun-linux-x64-baseline.zip`.
-3. **`pir` needs python3 + fzf**, neither shipped. The fix is folding it into
+2. **`pir` needs python3 + fzf**, neither shipped. The fix is folding it into
    `sl0ppi agent --resume` (already designed in `docs/cli-design.md`).
-4. **Tab overflow.** `sl0ppi open <name>` wants to be a fuzzy picker once a root
+3. **Tab overflow.** `sl0ppi open <name>` wants to be a fuzzy picker once a root
    has a dozen projects.
-5. Button polish: shift/right-click for the other split direction; reuse
+4. Button polish: shift/right-click for the other split direction; reuse
    `status_bar_button_style` so it looks pressable. Extend `make check-live`
    rather than trusting a snapshot.
 
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 675f82d..18c057c 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -457,6 +457,27 @@ Content and further click targets: a close-`x` per tab, session name → session
 manager, mode indicator → unlock, drag-to-reorder tabs. Also: the pane-split `+`
 and the new-tab `+` are currently the same glyph for different verbs.
 
+## Fixed: the vendored bun required AVX2
+
+The tarball shipped bun's default x64 build, which needs AVX2 — so on a plain
+KVM guest sl0ppi installed cleanly and then died with `Illegal instruction` the
+first time anything ran pi. `packaging/fetch-vendor.sh` now fetches
+`bun-linux-x64-baseline.zip`.
+
+Verified without needing such a machine, under an emulated CPU that has no AVX2:
+
+```bash
+qemu-x86_64 -cpu Nehalem vendor/cache/bun-*/bun --version   # baseline: 1.3.14
+qemu-x86_64 -cpu Nehalem /tmp/bun-linux-x64/bun --version   # default:  Illegal instruction
+```
+
+(That qemu-user binary is the one the tenet tracer builds, at
+`~/dev/tenet/tenet-original/tracers/qemu-user/qemu-build/build/qemu-x86_64`.)
+
+The baseline binary still contains 641 AVX2-only instructions against the
+default's 10980 — those are runtime-dispatched paths in bundled libraries,
+which is why running it is the check that matters rather than counting opcodes.
+
 ## Standing risks
 
 **`sl0ppij/target` is a symlink to `~/lol/zellij/target`.** Introduced when the