Prepare v0.5.0 reliability release

[Wibias]

Stack

Release/documentation follow-up to #228. This PR targets reliability-regression-performance-gate so the v0.5.0 release metadata and documentation are verified against the complete reliability/convergence rewrite before that leaf lands on main.

What changed

• bump package.json from 0.4.0 to 0.5.0
• add a dedicated 0.5.0 changelog section for the actual v0.4.0...#228 source delta while leaving pre-existing Unreleased entries untouched
• update the README across quick start, progress-control summary, safety model, watchdog section, architecture table, development controls, and current-state description
• align references/agent-progress-watchdog.md with the final v0.5 runtime, evidence, controller, replay, active-turn, and finalization contracts
• remove the stale policy/docs claim that generic PostToolUse compaction replaces successful tool output
• document that a verified current protected stream supersedes stale hook-era degradation metadata

v0.5.0 reliability contract documented here

• shared detection across agent-message, reasoning-summary, supported raw-reasoning, and plan generated text
• hard no-progress character/output-token bounds using plan/diff/token progress signals
• tool-call emission and malformed <atool> protocol-stall detection
• semantic evidence identity/coverage and source-owned output economy
• persistent workflow route/phase controller with checkpoint/resume and bounded progress budgets
• release-blocking deterministic incident replay plus false-positive finalization coverage

npm / npx

No additional bootstrap implementation is required for this version bump. The existing public npm package remains a thin npx github-delivery bootstrap whose installed skill payload comes from the separately verified stable GitHub Release. The protected tag release workflow already validates the npm package and runs npm publish --access public; package.json is the version source and there is no repository package-lock.json to update.

If the npm package has not yet had its one-time registry bootstrap / Trusted Publisher setup performed, that remains an operational first-publication prerequisite rather than source code for this PR.

Release boundary

This PR prepares source metadata and documentation only. It does not create v0.5.0, publish npm, or publish a GitHub Release. The existing protected release workflow remains the publication boundary after the release-prep source is merged and explicitly tagged/dispatched.

Validation

The PR should pass the full required CI matrix, Architecture Contracts, Dependency Review, CodeQL, npm package validation, release-contract checks, and the v0.5.0 reliability gate on the exact head before it is considered ready.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.