v1.33.0

What's Changed

• chore: sync version 1.32.1 to staging by @rapiercraft-forgedock[bot] in #4520
• fix(lean): turn-budget overrun ends as needs-human instead of the typed budget.exceeded from #4392 (#4505) by @rapiercraft-forgedock[bot] in #4529
• fix(engine): Depends-on regex prefix backtracks cubically on long whitespace (untrusted issue body stalls orchestrate) (#4517) by @rapiercraft-forgedock[bot] in #4530
• fix(execution): hybrid placement only sees root-level heavy markers, so monorepo lanes never offload (#4523) by @rapiercraft-forgedock[bot] in #4531
• fix(lean): light lane gaps to close before lean.light.mode: on (gate bypass, typed errors, self-check, contract, timeouts, A/B tag) (#4502) by @rapiercraft-forgedock[bot] in #4532
• fix(depcache): a failed snapshot materialize leaves the lane with no node_modules (no fallback install), and the pnpm error is lost (#4522) by @rapiercraft-forgedock[bot] in #4534
• fix(lean): paused lanes burn the 60-min CLI timeout; SIGTERM 143 becomes engine-error and trips the breaker (#4518) by @rapiercraft-forgedock[bot] in #4533
• fix(conformance): hotspot_growth blocks lanes on generated files (OpenAPI spec archives) (#4519) by @rapiercraft-forgedock[bot] in #4539
• fix(sequence): concurrent lanes renumber migrations to the same number, and the byte-identical check rejects the required header change (#4526) by @rapiercraft-forgedock[bot] in #4538
• fix(review): validators with "no recorded result" fail the review as conformance.unimplemented even when CI is green (#4527) by @rapiercraft-forgedock[bot] in #4536
• fix(orchestrate): sandbox.capacity (pool full) counts toward maxDeferrals, so a queue deeper than the compute pool is skipped within minutes (#4528) by @rapiercraft-forgedock[bot] in #4541
• fix(orchestrate): a needs-human PR is never re-synced with its base, so its conflicts grow while the milestone moves (#4525) by @rapiercraft-forgedock[bot] in #4537
• feat(pool): import computeshare router, agent, installers and lane image as bin/pool and pool/ (#4543) by @rapiercraft-forgedock[bot] in #4551
• follow-up: 1 deferred item(s) (deferred from #4528) (#4540) by @rapiercraft-forgedock[bot] in #4552
• feat(pool): native Linux/systemd agent installer (#4548) by @rapiercraft-forgedock[bot] in #4554
• feat(pool): forgedock pool router|enroll|status|upgrade|remove CLI (#4544) by @rapiercraft-forgedock[bot] in #4555
• feat(execution): execution.provider pool with default endpoint to the local router and forge.yaml injection (#4546) by @rapiercraft-forgedock[bot] in #4556
• fix(execution): remote placement ignores host-only capabilities (SOPS key, ops credentials, prod monitor SSH) so lanes block as needs-human credentials (#4542) by @rapiercraft-forgedock[bot] in #4553
• feat(pool): lane image version lock and forgedock update triggers pool upgrade (#4545) by @rapiercraft-forgedock[bot] in #4557
• feat(pool): per-agent remote lane minutes in batch report and pool utilisation in forgedock stats (#4549) by @rapiercraft-forgedock[bot] in #4558
• feat(orchestrate): opt-in local fallback in mode remote when the pool has no capacity; expose agent liveness (#4547) by @rapiercraft-forgedock[bot] in #4559
• fix(pool): enrollment accepts proto as an install code; Bearer regex ReDoS; sandbox git identity by @rapiercraft-forgedock[bot] in #4561
• ci(dco): one-time exemption for 25 sandbox commits (forgedock@localhost) by SHA by @rapiercraft-forgedock[bot] in #4562
• ci(dco): one-time SHA exemption on main (pull_request_target reads main's dco.yml) by @rapiercraft-forgedock[bot] in #4563
• fix(pool): agent proto sandbox ids, scoped git credential helper, image parity with computeshare, budget.exceeded docs by @rapiercraft-forgedock[bot] in #4568
• Release: built-in remote compute pool (computeshare), lane timeout/budget/deferral fixes, depcache fallback, sequence renumber lock by @rapiercraft-forgedock[bot] in #4560

Full Changelog: v1.32.1...v1.33.0