v0.48.0 - Helia Cloud Sync Hardening

Highlights

• Introduced full si helia cloud workflows for profile sync, vault backup sync, token lifecycle, audit inspection, and health diagnostics.
• Hardened vault cloud backups so Helia auto-sync now refuses plaintext dotenv payloads.
• Improved runtime reliability across login/browser behavior, vault/git safety checks, and CI coverage for Helia sync paths.

Added

• Added the si helia cloud command surface for account auth, codex profile sync, vault backup sync, token lifecycle, audit listing, and health diagnostics.
• Added Helia-focused CI coverage and subprocess round-trip tests for profile sync and vault backup flows.
• Added Helia cloud-sync operator documentation and settings reference coverage ([helia]).
• Added native Go SSH transport support for SI PaaS remote deploy workflows, with companion architecture runbook documentation.

Changed

• Updated GitHub and Cloudflare auth resolution so account credentials can be sourced directly from SI vault key references.
• Improved si login browser/headless behavior and clarified Safari accessibility guidance for profile-aware URL opening.
• Simplified si build image mode selection while preserving native docker buildx progress output behavior.

Fixed

• Stabilized SI CI lanes (SI Tests and Helia-focused workflow checks) by fixing empty-env headless detection and formatting gate regressions.
• Fixed si vault write paths to refuse updates when git index flags (skip-worktree/assume-unchanged) could hide dotenv changes.
• Fixed si logout-all behavior to block unintended auth-cache recovery after explicit logout.

Security

• Hardened Helia vault auto-backup hooks to skip uploading dotenv files containing plaintext keys, preventing accidental plaintext secret sync to cloud storage.

Upgrade Notes

• No breaking CLI command renames in this release.
• If you use Helia auto-sync, ensure vault files are encrypted (si vault encrypt) before expecting automatic cloud backups.