alint v0.14.0

What's Changed

• docs(bench): v0.13.0 bench-scale results (clean quiet-host rerun) by @asamarts in #74
• chore(actions)(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0 in the actions-patch-and-minor group across 1 directory by @dependabot[bot] in #45
• chore(deps)(deps): bump the patch-and-minor group across 1 directory with 3 updates by @dependabot[bot] in #68
• chore(actions)(deps): bump codecov/codecov-action from 6 to 7 by @dependabot[bot] in #75
• chore(actions)(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #76
• fix(roadmap): bump WASM plugins to v0.14 (foundations took the 0.13.0 cut) by @asamarts in #77
• fix(lsp): harden shared state against lock poisoning by @asamarts in #78
• chore(ci,docs): SHA-pin bench docker actions, refresh stale pins + release docs by @asamarts in #79
• fix(cli): honor --format on list/explain; add --only; agent fix_command by @asamarts in #80
• fix(docs): correct schema-invalid config examples; add doc-example gates by @asamarts in #81
• ci(docs-bundle): bridge main-tracked rule reference pages into the bundle by @asamarts in #82
• docs(design): baseline mode — design doc + ADR-0006 (Phase 4 draft) by @asamarts in #83
• feat(core): baseline fingerprint + JSON-Lines file (slice 1 of baseline mode) by @asamarts in #84
• feat(core): Violation.baseline_key + &Violation fingerprint wrapper (slice 2) by @asamarts in #85
• feat(core): baseline report-suppression transform (slice 3) by @asamarts in #86
• feat(cli): wire baseline mode end-to-end (slice 5) by @asamarts in #87
• feat(baseline): per-rule baseline_key audit + collision-invariant gate (slice 4) by @asamarts in #88
• feat(baseline): baseline: config key (top-level, extends/nested-rejected) by @asamarts in #89
• ci: make the self-hosted runner reliable (pids-limit + coverage OOM + likec4 gen-mermaid) by @asamarts in #90
• chore: remove stray empty oom file by @asamarts in #91
• ci(coverage): add timeout-minutes (90) to coverage.yml by @asamarts in #92
• feat(baseline): mark (not remove) baselined findings in SARIF + JSON by @asamarts in #93
• harden(baseline): audit follow-ups — correctness, robustness, perf, docs by @asamarts in #94
• fix: post-v0.13 audit follow-ups (doc-gate, --only, CI, docs) by @asamarts in #95
• perf(docs-bundle): skip the redundant release build in the rule-page bridge by @asamarts in #96
• fix(cli): empirical-audit follow-ups (baseline scope, option validation, CLI consistency) by @asamarts in #97
• feat(rules): implement root_only for the existence family by @asamarts in #98
• docs(changelog): correct the root_only fix note by @asamarts in #99
• fix(audit): close three "fail loudly" gaps from the post-v0.12 audit by @asamarts in #100
• fix(audit): docs + polish follow-ups from the post-v0.12 audit by @asamarts in #101
• docs(changelog): note the clap-example catch + post-audit coverage by @asamarts in #102
• ci: isolate untrusted fork-PR runs to ephemeral runners (H6) by @asamarts in #106
• Post-v0.13 security + correctness hardening (v0.14) by @asamarts in #103
• fix: post-v0.13 audit tail — contained security/correctness fixes (M2/M8/M10/M14 + L1–L14) by @asamarts in #107
• refactor: split the two files over rust-file-max-lines (Dog2) by @asamarts in #108
• test(dogfood): exercise the flagship rule families in .alint.yml (Dog1) by @asamarts in #109
• fix: post-v0.13 audit M-cluster (M3 OOM cap, M4 dir-symlinks, M11 exit-3, M13 --format) by @asamarts in #110
• fix: close 5 real bugs from the post-v0.13 e2e sweep by @asamarts in #111
• test(spawn-gate): RCE-canary + drift-guard suite for the process-execution trust gate by @asamarts in #112
• fix(output): non-UTF-8 paths no longer break json/agent + weird-path × format matrix by @asamarts in #113
• test(audit): symlink-vector scenario tests for the M2/H1/M5 confinement fixes by @asamarts in #115
• fix: remediate the adversarial review of #110–#115 (baseline bugs, M5 vacuity, drift-guard, polish) by @asamarts in #116
• docs: reconcile status/plan/tracking after the v0.14 hardening work by @asamarts in #117
• refactor(rules): git_tracked_only + respect_gitignore are kind-specific options (ADR-0008) by @asamarts in #118
• docs(v0.14): sentinel-gate root_only prose + A3 residual; pre-write baseline site docs (1b/1c/1d) by @asamarts in #119
• docs(v0.14): record 2a/2b/3 outcomes + the case-study count-divergence finding by @asamarts in #120
• chore(deps)(deps): bump the patch-and-minor group across 1 directory with 6 updates by @dependabot[bot] in #114
• chore(actions)(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in #104
• fix(docs): audit remediation — description gate, docker/release/action fixes by @asamarts in #121
• docs(site): add a narrative alint suggest guide by @asamarts in #122
• feat(docs): render the CLI landing page as formatted tables (drift-proof) by @asamarts in #125
• fix(docs-bundle): strip unreleased since-blocks from the main-overlaid docs by @asamarts in #126
• fix(docs-bundle): fetch strip-since.mjs from main before running it by @asamarts in #127
• docs(rule-authoring): rewrite for accuracy, completeness, and house style by @asamarts in #128

Full Changelog: v0.13.0...v0.14.0