Citadel v1.4.0

OpenCode archive correction

OpenCode users should use v1.4.1. The v1.4.0 downloadable archive omitted core/contracts/events.js, preventing its OpenCode plugin from loading. The v1.4.0 source checkout includes that dependency. Version 1.4.1 corrects the archive and adds extracted-archive regression tests.

What's Changed

• fix: preserve permission boundaries in agent guidance by @SethGammon in #286
• chore(deps): bump hashgraph-online/ai-plugin-scanner-action from 1.2.570 to 1.2.640 by @dependabot[bot] in #281
• feat(opencode): add opencode as a third Citadel runtime by @brandstaetter in #282
• fix: bind config receipts to explicit runtime identity by @SethGammon in #291
• fix: make multi-runtime installs portable and idempotent by @SethGammon in #292
• fix: surface and protect against ambiguous runtime detection in init-project by @brandstaetter in #294
• fix: complete mixed-runtime install contract by @SethGammon in #295
• chore: release Citadel v1.4.0 by @SethGammon in #296

Full Changelog: v1.3.7...v1.4.0