v4.3.0 — gold-standard hardening

A quality-and-hardening release from a deep, multi-round independent audit
(each finding double-checked against the real code before it was trusted). It fixes
real bugs — including several security-gate gaps — and grows the test suite from 135
to 198 tests. No change to how you use the tool; the roster stays 38 agents /
32 skills, and no agent, skill, hook or safety gate was removed.

Security fixes

• Closed a way to bypass the publish / go-public safety gate using GitHub's gh api
  command (both spaced and attached forms, and default-to-public repo creation);
  ordinary reads are unaffected.
• Closed a gap where creating an "internal" repository (visible to a whole
  organisation, so not really private) could slip past the go-public check.
• Removed a "slow regex" flaw where certain long commands could briefly freeze the
  safety check; it is now effectively instant.
• The secret scan is now much more thorough. It also checks: the git history a
  push would ship (across every local branch and tag, not just the one you have
  checked out — so git push --all / --mirror are covered), merge-commit
  content, commit and annotated-tag messages, files you force-add past
  .gitignore (including names with spaces), large text files (a plaintext key
  in a big database dump or log is caught), and text files carrying a stray non-text
  byte. Genuine pictures, fonts and other binaries are still skipped, and non-English
  text such as Bangla is treated as text.

Correctness & reliability

• Fixed false "all-clear" and false "blocked" results across several internal
  checks (indented / border-less / mixed-style tables, decorated "done"/"met"
  statuses, licence scanning on ordinary npm/TypeScript projects, and more).
• Reconciled the publish checklist to its full set of blocking checks everywhere it
  is described (with a guard so it can't drift), corrected the automatic AI
  model-cost chooser, hardened AI prompt-injection and key-handling guidance, and
  fixed the dashboard's colour contrast (light and dark) to meet accessibility
  standards.

Under the hood

• The automated test suite grew from 135 to 198 tests, with new mechanical
  guards so each fix cannot silently regress; all five safety checks stay green.

Full detail, including every disclosed residual limitation, is in
CHANGELOG.md and
SECURITY.md.