v0.0.22

What's Changed

• refactor(email): one sender seam so per-workspace BYO email resolves consistently (#3889) by @msywulak in #3890
• docs(datasources): fill ES/OpenSearch page gaps — SQL subset, profiling, host guidance by @msywulak in #3891
• feat(api): executeSQL per-query group target + reach-bounded GroupReachResolver (#3893) by @msywulak in #3897
• feat(api,web): Source catalog — auto + refinable group descriptions for agent routing by @msywulak in #3902
• chore(security): nonce-based script-src CSP for web; drop 'unsafe-inline'/'unsafe-eval' (#3899) by @msywulak in #3903
• fix(api): scope GET /api/v1/tables to the per-connection whitelist (#3898) by @msywulak in #3904
• fix(api): deploy-mode-gate global action-credential health check (#3905) by @msywulak in #3906

Full Changelog: v0.0.21...v0.0.22