v0.67.0

Changelog

Fixes

• b3ab2d4 fix(ci): make the Dippin validation gate fail-closed (SIFT-15-02, #594)
• 5bcf420 fix(parallel): propagate child-run usage through parallel branches (#595)
• 3f437be fix(release): stamp build identity into goreleaser binaries (#593)
• 5b8fb19 fix(tui): consume authoritative terminal status instead of reconstructing (#604)

Other

• ea09792 Merge pull request #616 from 2389-research/docs/sift-audit-2026-08-24
• 646390f docs(release): v0.67.0 — SIFT batch 1 (#593/#594/#595/#604/#607)
• edbf5bb docs: add SIFT codebase audit
• 843ba0c merge: TUI consumes authoritative PipelineEvent.TerminalStatus (#604)
• 31772dd merge: fail-closed pinned Dippin validation gate (#594)
• a865732 merge: preserve child-run usage through parallel branches for budget accuracy (#595)
• 488c6b0 merge: single parsed condition model from load through routing (#607)
• 159739e merge: stamp release build identity in goreleaser + verify in Homebrew test (#593)
• 947d3b1 refactor(pipeline): compile conditions once through one parsed model (#607)