v0.2.8

What's Changed

• test(brain): the paraphrase eval produces the fixture the deterministic suite consumes by @msywulak in #5157
• docs(reference): the two alias auto-approval knobs, and two counts that had drifted by @msywulak in #5159
• chore(audits): three audit checks that were silently passing by @msywulak in #5166
• docs(readme): the Company Atlas as the fourth context surface by @msywulak in #5167
• refactor(api): drop the retired email recipient-domain env fallback (phase 2 of #4479) by @msywulak in #5168
• docs(brain): two guides drifted from the code — and a guard for the contract snippet by @msywulak in #5169
• fix(ci): make Lighthouse reports actually land, and the PR comment tell the truth by @msywulak in #5170
• sec(privacy): the GDPR purge reaches the brain and KB data it claimed to remove by @msywulak in #5171
• docs(roadmap): #5160 — the GDPR purge reaches the brain and KB data it claimed to by @msywulak in #5177
• sec+legal: four decided calls — alias-knob visibility, the settings fail-open, the SLA figure, and the Annex I rule by @msywulak in #5178
• docs(roadmap): #5161–#5164 — four decided calls, and round 2's instance-not-class lesson by @msywulak in #5179
• sec(images): patch the runtime layers, and stop reporting what nobody can act on (#5181) by @msywulak in #5182
• sec(auth): block the native org-delete endpoint, which orphaned every workspace table (#5175) by @msywulak in #5183
• docs(platform-ops): the residue query missed every orphan it exists to find by @msywulak in #5184
• docs(roadmap): the security pass — a stale Caddy pin hiding under 1,000 duplicate alerts by @msywulak in #5186
• chore(operator): implement the residue sweep the runbook already prescribed by @msywulak in #5187
• fix(dashboards): gate on workspace permissions, not admin role — and stop bouncing a 403 to /login by @msywulak in #5190
• sec(dashboards): gate PUBLIC share behind dashboards:share, and clear the #5190 residue (#5192 + #5191) by @msywulak in #5193
• docs(roadmap): #5192 + #5191 — the public share link gets its own flag, and three CI jobs each found what the local tree cannot by @msywulak in #5195

Full Changelog: v0.2.7...v0.2.8