v0.55.0

Added

• Added synapse hub blackboard retention controls:
  --max-progress, --max-progress-per-author, --max-progress-per-task, and
  --max-findings-per-agent. The hub applies the same bounds during live
  operation and durable replay.
• Added a commercial licence evaluation path and checker coverage so public docs
  keep the AGPL/commercial boundary, self-service plans, and custom-contact
  requirements aligned.
• Added prototype Datalog-like and Cypher-like aliases for synapse event-query
  while preserving the existing read-only event-log execution model.
• Added the public policy-engine design, covering advisory local release rules
  for required tests, type checks, owner approval, evidence freshness, generated
  artifact parity, and no-merge-without-receipt.
• Added the public paranoid-mode design for one future operator switch that
  enables strict local settings and reports missing hardening hooks without
  claiming encryption, identity, ACL, or exposed-deployment guarantees.
• Added the public at-rest encryption design for optional local storage
  encryption scope, key lifecycle, rotation, backup recovery, and local-first
  tradeoffs before any encryption flag ships.
• Added the public end-to-end encrypted channels design for selected encrypted
  payloads, per-project/per-worktree keys, recipient sets, key rotation, member
  removal, and hub-visible metadata boundaries.
• Added the public private-channels design for project, worktree, task, and
  direct channel namespaces, membership lifecycle, history visibility, retention
  boundaries, relay filtering, and event-query filtering.
• Added the public signed-events and mTLS design for selected event signatures,
  key rotation, replay protection, verification results, trust bundles,
  certificate pinning, and trusted multi-host peer boundaries.
• Added the public per-message authentication design for authenticated frames,
  canonical frames, sender binding, replay cache bounds, key rotation,
  revocation, and verification-result boundaries after WebSocket connect
  authentication.
• Added the public identity and ACL design for per-agent identity,
  identity-bound credentials, project namespace permissions, allowed verbs,
  target patterns, metrics/A2A/dashboard/release privileges, deny-by-default
  authorization, credential rotation, revocation, and shared-token migration.