- history.db and images/*.png are now created with 0600 permissions
(owner-only) instead of default umask, since clipboard history can
contain plaintext passwords/tokens.
- breadclipd never persists clipboard content flagged with the
x-kde-passwordManagerHint MIME type (the convention KeePassXC,
Bitwarden, etc. use to mark content they own).
- Replaced breadclipd's 500ms busy-poll loop (2-3 wl-paste forks per
cycle, forever) with wl-paste --watch, so it only reacts on actual
clipboard changes.
- Documented both behaviors in the README.
GitHub Actions self-hosted runners need per-repo registration on a
personal account; Forgejo Actions' runner already serves every repo
with zero setup. Moves release publishing there (dl.breadway.dev stays
the primary bakery target; GitHub release upload is kept as the
fallback via an explicit token, since Forgejo Actions has no ambient
GITHUB_TOKEN) and adds a mirror workflow to keep GitHub in sync
automatically.
