Release v0.22.0

[emal-avala]

Summary

Cuts v0.22.0. Minor bump per semver — 13 commits since v0.21.1, mostly the Phase 8.12 services pillar (OAuth, policy/rate-limit, notifier, tips, settings-sync) and the first slice of 8.10 (subagent color manager).

Changelog

See CHANGELOG.md for the full entry. Highlights:

• Service layer (8.12): OAuth 2.0 + PKCE, policy/rate-limit gate, cross-platform desktop notifier, rotating tips surface, opt-in settings-sync.
• Subagent UX (8.10 first slice): stable per-agent color assignment.
• Security: HMAC-SHA-256 in settings-sync (replaces length-extension-vulnerable construction), OAuth state-param mandatory, OAuth credentials preserved on transient refresh failure, OAuth HTTPS enforcement, OAuth browser launcher exit-status, policy-quota leak on cancellation, TUI bridge handles AnsiValue.
• Deps: tokio 1.52.1 → 1.52.2.

Files bumped

File	Field	Old	New
crates/lib/Cargo.toml	version	0.21.1	0.22.0
crates/cli/Cargo.toml	version + agent-code-lib path-dep	0.21.1	0.22.0
crates/eval/Cargo.toml	agent-code-lib path-dep	0.21.1	0.22.0
npm/package.json	version	0.21.1	0.22.0
Cargo.lock	re-resolved at 0.22.0

Test plan

• cargo build --release --locked green on linux
• cargo fmt --all -- --check clean
• cargo clippy --all-targets -- -D warnings clean
• CI green on the PR (binaries / Docker / npm publish gated on tag push post-merge)