Keys leave preferences, and edits check the package they touched

New

• Provider keys live in ~/.vortex/provider-keys.json (mode 0600). Keys you already saved in Settings move there on launch. The headless CLI still prefers environment variables and --api-key, and falls back to that file. Keys are not written to logs. Docs: Models and keys.
• After a batch of local edits, Vortex runs a package-scoped typecheck — cargo check for the owning crate, or tsc against the nearest tsconfig — and attaches the result to the edit. A timeout, or a checker that did not start, attaches nothing, so a failed check is never reported as clean. Turn it off with VORTEX_POST_EDIT_TYPECHECK=0 or limits.post_edit_typecheck in ~/.vortex/config.toml.
• Long pages from fetch_url come back in chunks. The truncation notice includes the next offset.

Fixed

• A search-and-replace, line edit, diff, or multi-file edit could be refused because the file's hash changed, even when the text it was replacing was still there. Those edits use the text they match as the freshness check. A full overwrite still refuses when the file changed since the agent last read it.
• A multi-file edit locks and snapshots every file it names.
• A symlink that leaves the workspace asks you before the tool follows it.
• Destructive commands hidden behind a shell, a full path, a wrapper, or aimed at your home directory are blocked. Ordinary project commands still run.
• Code outlines for languages the parser understands come from the syntax tree. Other languages keep the previous outline.
• Log lines that look like credentials are redacted before they are written.