v0.29.0

• Pre-PR guard: before orch pushes a task, its diff is scanned. Secrets (GitHub/AWS/Slack/Anthropic/OpenAI/Google/Stripe keys, private keys, .env files) block the task; debug leftovers (console.log, debugger, breakpoint()…) are listed in the PR body. Config guard.secrets / guard.debug: block | warn | off.
• Agent watch: orch run flags an agent whose log goes silent (watch.stall_after_s, default 10 min) or that repeats the same call, with the orch task stop command to end it. New events in the dashboard.
• Conflict radar: radar: warn | serialize | off compares a task's files with the running ones before dispatch, and a new PR with the other open PRs after.
• orch tui: a live read-only terminal view — tasks, phases, spend per provider and the selected task's log.
• Sandbox (Linux, opt-in): dispatch.sandbox: true confines each agent to its worktree with Landlock; dispatch.sandbox_allow adds paths (e.g. your Claude hooks). orch doctor checks support. No network restriction yet.
• New dependencies: golang.org/x/term, github.com/landlock-lsm/go-landlock.

What's Changed

• feat(guard,engine): a pre-PR guard blocks secrets and warns on debug leftovers (#484) by @hectorcanaimero in #488
• feat(engine,dashboard): orch run flags stalled and looping agents while they run (#487) by @hectorcanaimero in #489
• test(guard): time the scan as the best of three runs so a loaded machine cannot fail it by @hectorcanaimero in #492
• feat(engine): conflict radar flags overlapping tasks before dispatch and conflicting PRs after (#482) by @hectorcanaimero in #490
• feat(cli): orch tui, a live read-only terminal view of the run (#483) by @hectorcanaimero in #491
• feat(engine,doctor): dispatch.sandbox confines each agent to its worktree with Landlock (#481) by @hectorcanaimero in #493

Full Changelog: v0.28.0...v0.29.0