Added consistent non-empty version output for:

curl --version in packages/bare-os-coreutils/src/curl.js
wget --version in packages/bare-os-coreutils/src/wget.js
openssl version and openssl --version in packages/bare-os-coreutils/src/openssl.js
nano --version (via edit) in packages/bare-os-coreutils/src/edit.js
Updated tar compatibility in packages/bare-os-booter/lib/tar-cli.js:

Added tar --version
Added grouped short-flag parsing (-czf, etc.)
Added first-arg legacy cluster parsing (czf)
Added - archive target support for create/list/extract stream paths
Kept implementation as ustar subset (accepts z for compatibility parsing)
Fixed pipeline/timeout behavior:

Optimized head line mode to stop scanning early (no full split) in packages/bare-os-coreutils/src/head.js
Added bounded safety for yes cap in packages/bare-os-coreutils/src/yes.js
Hardened timeout so timed-out commands reliably produce exit code 124 in packages/bare-os-coreutils/src/timeout.js
Added scoped expr compatibility in shell:

Prevented pathname expansion of bare * only for expr arithmetic-token case in packages/bare-os-booter/lib/shell.js
Added glob option plumbing in packages/bare-os-booter/lib/shell-glob.js

kernel/bin/openssl

@@ -91,6 +91,16 @@ function bareOsEmitRaw(ctx, chunk) {
  * OpenSSL CLI compatibility via booter `openssl-cli.js` (bare-crypto).
  */
 async function run(ctx, argv) {
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '--version' || argv[i] === '-V') {
+      ctx.console.log('OpenSSL (Bare OS crypto subset) 0.1')
+      return
+    }
+  }
+  if (argv[1] === 'version' && argv.length === 2) {
+    ctx.console.log('OpenSSL (Bare OS crypto subset) 0.1')
+    return
+  }
   if (typeof ctx.bareOsRunOpensslCli === 'function') {
     await ctx.bareOsRunOpensslCli(argv)
     return