v0.7.2

What's Changed

• fix(security): env-scope the default claude dispatch backend (SEC-F1) by @dhh1128 in #6
• docs(agents): correct stale "no CI workflows" instruction in AGENTS.md (OPS-F2) by @dhh1128 in #7
• fix(ci): run the branch-coverage gate in release.yml before publishing (OPS-F1) by @dhh1128 in #8
• test: dedupe handler fixtures into conftest + fix flaky scan-order test (TST-F1, TST-F2) by @dhh1128 in #9
• docs: refresh stale architecture.md to match current code (MNT-F1) by @dhh1128 in #11
• fix(security): pin git binary + enforce https-only update fetch (SEC-F3, SEC-F5) by @dhh1128 in #10
• refactor: type InvariantContext fields + remove vestigial lock_mode (MNT-F3, MNT-F4) by @dhh1128 in #13
• refactor: dedupe command-module helpers + fix raw TODO comments (MNT-F2, TST-F5, MNT-F5) by @dhh1128 in #14
• test: deterministic clock in prune date-helpers + handler grace-period coverage (TST-F3, TST-F4) by @dhh1128 in #15
• ci: add secret-scanning gate, harden checkout creds, expand .gitignore (SEC-F2, OPS-F4, OPS-F3) by @dhh1128 in #12
• chore(reviews): persist + disposition 2026-06-05 review-panel artifacts by @dhh1128 in #16

Full Changelog: v0.7.1...v0.7.2