v4.16.0

What's Changed

• docs(npm): on-promise package description (LED-3700, STR-2195) by @infracore in #150
• feat(hooks): STR-2202 "tools fire tools" — HOOK half (SessionStart digest echo + subagent flight-recorder) by @infracore in #151
• fix(bundle): sync-gateway exclude parity + parity guard (proprietary-leak prevention) by @infracore in #153
• ci: fail-closed identity-guard (block non-anonymized commit identities) by @infracore in #154
• Glama coherence: DELIMIT_TOOLSET=core Docker pin + server.json version-sync by @infracore in #152
• feat(chat): launch pre-brief + honest launcher naming (Fable doc-33) by @infracore in #155
• feat(chat): add delimit chat --model <id> per-launch model selector by @infracore in #156
• Fix cross-namespace handoff receipts in bundled MCP (LED-2451) by @infracore in #157
• security(bundle): invert npm bundle to fail-CLOSED allowlist (LED-1879) by @infracore in #158
• chore(bundle): classify brand_notes.py INTERNAL (guard catch #1) by @infracore in #159
• chore(bundle): resync gateway bundle (memory projection budget fix) by @infracore in #160
• fix(docs): truth-drift corrections (banned phrase, phantom CHANGELOG, VERSION marker) by @infracore in #161
• docs: CHANGELOG 4.16.0 entry by @infracore in #162
• fix(release): never commit proprietary gateway source to the public repo (LED-1900) by @infracore in #163
• release: v4.16.0 by @infracore in #164
• fix(release): gateway/VERSION marker ordering (unblocks v4.16.0 publish) by @infracore in #165

Full Changelog: v4.15.0...v4.16.0