- Add 'okf restore' command to reinstall vendor bundles from okf.lock
- Allow 'okf pull' without arguments to restore from okf.lock
- Skip already installed bundles during restore unless --force is specified
- Harden 'okf vendor remove' to require exact bundle ID match and index.md
- Prevent deletion of parent namespace directories on prefix remove
- Automatically clean up empty okf.lock when last vendor bundle is uninstalled
- Mitigate G110 (decompression bomb) and G304 (path traversal) in package unpacker
- Fix errcheck and staticcheck lint warnings across CLI and test suites