v0.29.0

What's Changed

• fix(mcp): surface tool error messages lost since mcp 2.0 by @Kohei-Wada in #1256
• test(server): cover fix-actual validation for duration and end<start by @Kohei-Wada in #1257
• fix(server): warn on unauthenticated non-loopback bind and bound request sizes by @Kohei-Wada in #1258
• refactor(core): use injected ITimeProvider in the task write path by @Kohei-Wada in #1259
• chore(ci): workflow hygiene — concurrency, typecheck env, mypy configs, pinned publish by @Kohei-Wada in #1260
• fix(server,client): send WebSocket API key in X-Api-Key header by @Kohei-Wada in #1262
• fix(client): close error-handling gaps and fail fast on unreachable servers by @Kohei-Wada in #1263
• refactor(server): drop dead analytics handlers, type period, explicit delete model by @Kohei-Wada in #1264
• perf(core): build optimization summary from the already-fetched tasks by @Kohei-Wada in #1265
• chore(tui): remove stale TCSS selectors by @Kohei-Wada in #1266

Full Changelog: v0.28.1...v0.29.0