jpdev v0.6.0

jpdev v0.6.0

Seven rows of the milestone, in four pull requests (#24, #25, #26, #28): the kit stops costing a build a run for things the repository already knows, and a review becomes one command.

What it holds

• CI after an automated branch update (#22, pull request #24). templates/update-branches.yml prefers an UPDATE_BRANCHES_TOKEN secret and falls back to GITHUB_TOKEN; on the fallback it waits for the updated head and dispatches ci.yml with the pull-request number and the head's SHA, so the required check and handover jobs run on that head. A fork's head is never dispatched: the run says so and fails visibly. A dispatch failure propagates; it is never mistaken for a merge conflict.
• The vendored handover check (#21, pull request #24). lib/handover_check.sh is vendored as scripts/dev/handover_check.sh with the kit's version line; the CI template calls that path; tests and the release gate hold both vendored scripts to their sources.
• The declared venv (#23, pull request #25). jpdev setup and jpdev check create the virtual environment dev.json names when it is missing, resolving the interpreter from the PATH or a pyenv version directory, else refusing with the version named; the path is validated as a relative child of the clone; every Python step runs with the venv first on its PATH and its summary names the interpreter.
• jpdev codex review (#13, pull request #25). A read-only Codex run from a review brief with the model, effort and sandbox explicit, no network unless --network is passed and logged, the record written to a file, the reviewed SHA printed, a refusal if the clone changed; jpdev codex brief-template --review prints the review skeleton with its two result lines.
• Brief words inside backticks (#12, pull request #26). check-brief treats text inside paired backticks as an identifier, path or command; a bare word is still refused with the same suggestion; unbalanced backticks exempt nothing; the product's own term left the list.
• codex run --add of a directory (#16, pull request #26). Every eligible file below the directory is committed; the handover files at any depth, ignored files and caches are left out; a directory with nothing to add is refused by name.
• Retained check logs (#8, pull request #28). Each step's output is kept under the scratch directory's logs/; when the log cannot be written the check still runs, its result is reported with the persistence failure named beside it, and the exit status stays the check's.
• Repository notes in briefs (#27, pull request #28). dev.json admits a notes list of plain sentences; brief-template prints them under ## This repository's notes; check-brief --build requires that heading when the manifest has notes.

What it does not hold

Running Codex itself in GitHub Actions; a second storage kind for anything; the re-vendor of adopting repositories, which follows this release as its own rows, the specification's first. The update template's fallback dispatch needs workflow_dispatch on the adopting repository's CI workflow, which the re-vendor brings.