v0.0.27 — Cold-Start Activation

What's Changed

• feat(www,docs): public /security page + make the SQL-safety story legible (#3923) by @msywulak in #3926
• docs(roadmap): #3923 shipped — /security page off the v0.1.0 blocker list by @msywulak in #3927
• feat(web,api): cold-start activation polish — first-answer instrumentation + funnel fixes by @msywulak in #3928
• fix(www): split footer into product + legal tiers by @msywulak in #3929
• docs(roadmap): #3925 cold-start audit shipped; F1 composer dead-end flagged P0 by @msywulak in #3930
• feat(web): success-page starter prompts derive from connected dataset (F4) by @msywulak in #3937
• feat(web): demo empty-state loading skeleton + cold-start fallback prompts (F5) by @msywulak in #3938
• fix(api): demo-onboard composer dead-end — seed demo semantic layer as published (#3932) by @msywulak in #3940
• docs(roadmap): #3932 composer dead-end shipped (PR #3940) — F1 P0 cleared by @msywulak in #3941
• fix(web): recover stale/expired session-cookie trap (F2, #3933) by @msywulak in #3939
• feat(api): configurable demo model — default Haiku on gateway (#3931) by @msywulak in #3942
• feat(api,web): demo tracking page + per-turn latency persistence (#3931) by @msywulak in #3944
• docs(roadmap): #3931 PR2 shipped (PR #3944) by @msywulak in #3946
• fix(web,api): F3 region-step resolution — retry copy + regions-error alert by @msywulak in #3945

Full Changelog: v0.0.26...v0.0.27