oUpdate 0.2.4

Security release. Upgrade from 0.2.3 or earlier; it tightens what the review and the gate accept.

Review

• A release lands only on a pass from the pre-pass or the reviewer; a cooldown or advisory alone no longer lands it, and a skipped reviewer layer alone no longer lands a release.
• A package the pre-pass stops is held without going to the model.
• A reviewer answer that lacks the expected response headers is rejected (expectHeaders). A 503 or refused connection from the reviewer route is retried with short backoff under one deadline per base.
• A file/symlink type change counts as changed. Plain source maps and declaration files are shown as a hash so a clean release is not held over budget; a map any non-map file names is shown.
• Lockfile entries with no source or hash are held as unhashed in npm and pnpm alike; names and versions outside the registry grammar are rejected and escaped when shown.
• Registry script bodies are fenced in the npm lane prompt.

Gate

• A pending status is posted when no change was actually reviewed.
• Layer details and lockfile parse errors are escaped in the gate comment.

Other

• SECURITY.md with private reporting.
• CI typechecks and tests on pull requests and main.