Ships M4b's full surface plus four iterative audit passes plus the
GitHub Actions Node 20 deprecation sweep across all of this account's
repos.

Capabilities shipped:
- Env-var-resolved secrets with 1Password shell-init seeding
- /v1/notify Worker proxy for PWA-side ntfy (PWA never touches ntfy.sh)
- Unified ntfy body format across CLI and PWA
- Tap-to-open notifications via X-Click
- Consumed/expired hidden by default with Show archive toggle
- Forget action for receipt-only messages
- Sandboxed-install guard (NTS_HOME suppresses shell-env identity)

Audit hardening:
- Worker POST in CORS allow-methods, topic regex, click-URL allowlist
- secret::resolve trims whitespace
- PWA validateBundle catches notify.enabled=true with empty ntfy
- deleteMessage cleans local cache on immediate success

Test totals at this boundary: 91 unit + 42 integration (Rust),
152 unit + 2 e2e (PWA), 55 (Worker). Total 342.

CI shipped via .github/workflows/test.yml. Dependabot config shipped
to all 5 repos for the next Node-runtime deprecation cycle.

See docs/handoffs/2026-05-13_m4b-mac-iphone-shipped.md for the
full handoff including known footguns and next steps.