v0.5.0: production hardening

Closes the open items in FLAWS_AND_GAPS.md and the unfinished or stubbed items from v0.1–v0.4. FLAWS_AND_GAPS.md now has two parts: what is fixed, and what is still open and why.

Highlights

• PostgreSQL + pgvector backend for the whole store (COMMONS_DB=postgresql://…), plus commons migrate-postgres
• Optional encryption at rest (SQLCipher, COMMONS_DB_KEY) and AES-GCM encrypted backups
• HTTP auth for reads and writes: API keys or OAuth 2.1 (introspection + protected-resource metadata), per-project ACLs, rate limiting
• Per-agent trust scores that weight search and the KB
• Escalation ladder for stuck or unassignable tasks: reassign, then the distributor model, then a user notification (+ webhook)
• Catch-up policies for missed recurring runs (skip, once, all)
• In-process background maintenance thread with a leader lease
• Retention: usage rollup, context-pack GC, log trimming. Scheduled and encrypted backups. Full dump/import
• A2A server: send, stream (SSE), get, cancel, resubscribe, agent card. Client polling and streaming
• Tree-sitter JS/TS indexing (optional, regex fallback kept). Python and JS call targets resolved through imports and scope
• Semantic topic clustering, exact token counting (tiktoken, Anthropic/Gemini count APIs)
• Vault dynamic secrets with lease revocation, a real Infisical adapter, entropy-based redaction
• Dashboard: HTTPS, SSE live updates, per-user viewer/admin tokens, System tab
• Routing A/B validation with automatic revert proposals
• MCP hub: pooled sessions, per-agent credentials, upstream OAuth (client credentials/refresh), catalog verification
• Semantic dedupe of jobs and leftovers, research corroboration, secret-ref masking in exports, optional OpenTelemetry
• Worker presets checked against the vendors' current CLI docs (claude -p, codex exec, cursor-agent, gemini)

Tests: 89 passed, 1 skipped on SQLite. The skipped test is Postgres-only. All 90 pass against PostgreSQL 16 + pgvector (COMMONS_TEST_PG).

See FLAWS_AND_GAPS.md for what is still open: live account testing of Vault, Infisical, IdP and the CLIs, the limits of prompt-injection defences, rate limiting across replicas, and more.