Ghostify v2.0.6

Added

• Added an explicit Chrome Web Store artifact confirmation to the maintainer's
  live-verification checklist so an unpacked development build cannot be
  mistaken for the published package.
• Added Firefox desktop package preparation, validation, linting, deterministic
  extension and reviewer-source archives, and AMO submission documentation.
• Added maintainer ownership, private vulnerability reporting, and threat-model
  documentation for the project's security and release boundaries.

Changed

• Split daily status validation from proposal publishing so third-party build
  dependencies run with read-only repository access, and bot-created proposals
  explicitly approve required pull-request CI for their exact commit.
• Advanced the repository package identity to 2.0.6 so changes made after
  the published 2.0.5 tag cannot produce a second, different 2.0.5 ZIP.
• Replaced the legacy persisted configuration path with packaged,
  version-checked configuration and restricted page-bridge inputs to known
  settings and runtime pattern keys.
• Strengthened release checks with deterministic cross-platform ZIP output,
  exact approved-artifact hash matching, pinned Firefox tooling, dependency
  audits, and deploy-time website security headers.
• Reworked the website's privacy and verification evidence to link directly to
  public project records.

Fixed

• Preserved queue-routed Facebook group-message sends while removing bundled
  typing and Seen metadata, preventing affected messages from remaining stuck
  in the Sending state.
• Updated the Firefox development toolchain to the patched shell-quote
  release. Complete dependency reviews remain visible on daily proposals,
  website runtime advisories block proposal creation, and required pull-request
  CI keeps all high-severity dependency findings merge-blocking.
• Replaced production-shaped conversation labels and identifiers in Messenger
  regression fixtures with clearly synthetic values.
• Separated the published verification target from the repository version so
  reviewed status updates can remain accurate without requiring an extension
  release, and product-update history no longer overrides popup verification.
• Removed the redundant Chrome Web Store link and version-mismatch warning from
  the status summary card; the header remains the single installation action.