rune v0.5.2

Security and identity fix for cross-namespace registries.

- Credentials no longer persist in cached .git/config. Tokens injected
  transiently via GIT_ASKPASS, resolved fresh each operation.
- Per-registry git identity (git_email, git_name) set on clone.
  Ensures rune push commits with the correct email for each namespace.
- rune audit command for detecting content regressions across registries.
- Rewritten README with multi-registry auth documentation.