v0.90.0

Added

• CI installs its dev, benchmark, and docs toolchain from a hash-locked
  requirements file (--require-hashes), making every workflow's
  dependency set byte-reproducible; the universal resolution carries
  markers for all supported interpreters, and the regeneration command is
  documented in the file header.
• Secret scanning joins the commit gate: a gitleaks pre-commit hook
  refuses a staged secret, and the pre-commit workflow gained a
  digest-pinned full-tree sweep so a secret already in the checkout
  cannot hide behind an empty staging area. A repository .gitleaks.toml
  allowlists the one false positive (docstring type annotations naming
  Ed25519PrivateKey) and the gitignored build artefacts that mirror it.
• The deployment guide's exposure section gained a worked reverse-proxy
  example: a Caddyfile terminating TLS in front of a loopback hub, the
  client invocation through wss://, and the trust-store and per-host-cap
  considerations — validated end to end against a real proxy.
• synapse cross-repo --watch rescans the checkout tree and rejoins live
  claims every --interval seconds (--count bounds the refreshes): a
  TTY clears and redraws the report in place, piped output separates
  refreshes with a --- divider, --json --watch streams NDJSON, and the
  exit code reports the last refresh's --repo signal.
• synapse benchmark --compare BASELINE.json gates a run against a
  scorecard saved with --results: throughput and latency-percentile
  drift beyond --tolerance (default 25%, sized for shared-workstation
  noise) exits 1, ungated context metrics never gate, a baseline from a
  different CPU model is refused, and softer host drift (governor,
  interpreter, package version) is reported as loud warnings. Under
  --json the document gains a comparison object beside the scorecard.
• synapse cross-repo flags declared version constraints that can never be
  satisfied together: every package two or more scanned repositories
  consume — external packages included — is checked pairwise, and a
  version_conflict edge (red in DOT output) appears when the constraints
  are provably disjoint. The comparison models PEP 440 specifier sets,
  Cargo requirements, and npm semver ranges over plain numeric release
  versions; anything outside that bounded model — pre-release or epoch
  segments, direct URL references, go.mod requirements — never claims a
  conflict, and dependency-edge evidence now carries the declared
  constraint text.

Fixed

• --token-file naming a missing or unreadable file now fails with a clean
  cannot read token file message and exit code 2 instead of an unhandled
  traceback.