v1.6.4 - sanitization + CUE_VERSION drift fix

v1.6.4 (2026-07-05)

Sanitization

Per user feedback: "Pawly" is the user's private agent name (running on the public QwenPaw platform) — it is not the QwenPaw platform name, and related identifiers (uuid / Tailscale IP / host description / workflow filename) must not appear in the release tree. v1.6.4 strips every concrete personal value out of the tracked files; real peer configuration moves to a *.local.yaml overlay (gitignored).

Maintenance: agent-card version drift fix

After the sanitization commit was tagged v1.6.4, an operator deploying the image noticed that /.well-known/agent.json and /admin/status still reported version: "1.6.2" while the package __version__ was already "1.6.4". Root cause: core/a2a_client.py::CUE_VERSION was a hardcoded literal that hadn't been bumped across the v1.6.x series.

Fix (commit 824cf27):

• CUE_VERSION now derives from agentwire_cue.__version__, so the advertised version and the package version cannot drift.
• New regression test test_cue_version_matches_package_version asserts CUE_VERSION == agentwire_cue.__version__.
• Existing test_v150_regressions.py::test_agent_card_reports_current_version also made version-dynamic (was hardcoded "1.6.2").

Verified post-fix:

• /.well-known/agent.json -> version: "1.6.4" ✓
• /admin/status -> cue_version: "1.6.4" ✓
• 340 passed / 6 skipped test suite ✓
• Docker image rebuilt and container recreated (healthy) ✓

Required operator follow-up (still pending)

The Pawly A2A token literal value (ee8d7415...) leaked into commit f8fbfeb (v1.6.3) and is still extractable from git history. The secrets file secrets/peer-a-a2a-token.txt was rotated on disk but the server-side Pawly A2A token must be regenerated on Pawly's CORE to make the leaked value invalid. Until that rotation, anyone with read access to the historical blob can connect as Pawly.