Summary of important user-visible changes for devtools 0.2.1:
-------------------------------------------------------------

 This release serves programs on every system, sandboxed where the machine
 allows it, adds the sandbox on macOS, and fixes sandbox mode where Octave
 comes from a distribution package.

 ** `devtools.mcpEval ("Sandbox")` serves wherever Octave runs: inside a
    sandbox where the machine can build one, unconfined where it cannot.
    Every result states which, `"active"`, `"failed"` or `"unavailable"`, in
    `_meta["io.github.pr0m1th3as.devtools/sandbox"]`, with the reason for the
    last two in `.../sandboxReason`.  Each call runs in a process of its own and
    is stopped at the deadline; on Windows this needs a compiler at
    installation.

 ** The sandbox works on macOS, using the system's `sandbox-exec`.  There
    `/tmp` is not size-capped, and the network is shown unreachable rather
    than proven denied.  The server prints one OpenMP warning as it starts.

 ** Sandbox mode works where Octave is installed from a distribution
    package, where it refused to serve.

 ** The sandbox also checks that the root filesystem and every mounted folder
    refuse a write.

 ** `pkg test devtools` passes where `bwrap` cannot build its namespaces,
    as in an ordinary container, where eleven sandbox tests failed.

 ** `octave_which` names the package of a core function on Windows, and
    `octave_help` no longer answers with `*note` cross references.


Backwards incompatible improvements:

 ** `devtools.mcpEval ("Sandbox", true)` is now `devtools.mcpEval ("Sandbox")`,
    and `("Sandbox", false)` is gone.  The sandbox key holds a state where it
    held `true`, and a server whose sandbox fails serves unconfined instead of
    exiting, so a program that needs the sandbox must read the state.
