v2.21.3

Refresh the default CA bundle after an upstream security advisory and complete
the source-verifiable repository assurance evidence. Close four bounded-input
and filesystem gaps found in a fresh source review.

Security

• Require certifi>=2026.10.19 in runtime package metadata and refresh the
  locked CA bundle and fuzzing export for PYSEC-2026-4320
  (GHSA-6q48-6c7w-9gw2). The default HTTPX trust store no longer includes the
  distrusted emSign ECC root. Custom trust stores and operator-managed remote
  TLS ingress remain outside this bundle update; rebuild existing containers.
• Bind implicit workspace MCP configuration reads and atomic writes to retained
  directories. POSIX uses directory-relative operations; Windows rejects
  reparse points and retains ancestor locks and temporary guard entries.
  Explicit user-selected configuration symlinks remain supported.
• Render observed and diagnostic text literally in the Omarchy panel and
  settings so provider-controlled markup cannot trigger Qt image loading.
• Bound numeric regex repetition counts before compilation and specificity
  matching, including repeated zero-width assertions submitted over local MCP.
• Index capsule/cache insight and evidence references once during admission,
  preventing quadratic tuple scans while preserving exact evidence identity,
  order and duplicate occurrences.

Documentation

• Document the enabled private HTTPS vulnerability-reporting channel and refine
  the OpenSSF questionnaire evidence, including the optional remote adapter's
  authentication boundary, dated maintainer knowledge attestations and checked
  public issue/security-review history. Response-history gaps remain explicit.

Tool Surface Changes

Tool surface changes: no CLI command or flag changes.