v0.18.2

What's Changed

• fix(skills): prevent low-confidence skill injection (#2512, #2513, #2501) by @bug-ops in #2517
• fix(security): reclassify search_code as ToolResult, add PII NER input truncation by @bug-ops in #2518
• fix(memory): configurable SA timeout, tier promotion retry, orphan cleanup by @bug-ops in #2519
• feat(memory): wire StoreRoutingConfig and goal_text into memory recall path (#2484, #2483) by @bug-ops in #2520
• feat(tools): structured shell output envelope and per-path read sandbox by @bug-ops in #2528
• feat(mcp): MCP Elicitation support (#2486) by @bug-ops in #2521
• fix(mcp): bound elicitation channel, warn on sensitive fields (#2524, #2523) by @bug-ops in #2530
• feat(tools): document and configure [tools.file] read sandbox by @bug-ops in #2532
• feat(core): reactive hook events for CwdChanged and FileChanged (#2487) by @bug-ops in #2531
• feat(security): MCP/A2A security hardening — tool collision detection, SMCP lifecycle, IBCT tokens by @bug-ops in #2533
• fix(memory): soft-delete orphaned messages with legacy-only tool content by @bug-ops in #2534
• fix(tools): propagate claim_source in gate audit and detect relative paths by @bug-ops in #2539
• fix(classifiers): PII NER allowlist for false positives and metal feature documentation by @bug-ops in #2541
• refactor(zeph-llm): remove dead ModelOrchestrator in favour of RouterProvider by @bug-ops in #2546
• feat(mcp): elicitation during tool execution (phase 2) by @bug-ops in #2545
• fix(mcp): drain elicitation_rx concurrently in run_inline_tool_loop by @bug-ops in #2548
• release: v0.18.2 by @bug-ops in #2547

Full Changelog: v0.18.1...v0.18.2