v5.1.0

What's Changed

• fix(guard): #532 folded interpreter comments stay non-executable by @TARSDrakon in #537
• fix(cli): #515 --help must not run audit or reject allowlist by @TARSDrakon in #524
• fix(memory): #510 redact PII identifiers on memory write by @jarvis-drakon in #534
• chore(dashboard): #513 clear dashboard advisories; document postinstall refresh by @jarvis-drakon in #533
• test(memory): #510 pin the metadata-update repro from the #534 review by @jarvis-drakon in #540
• test(sessions): #538 redactor fail-safe regression tests + #534 review nits by @jarvis-drakon in #539
• fix(audit): #514 actionable human output, frontmatter-aware stealth rule by @jarvis-drakon in #530
• fix(credential-leak): #543 detect provider keys split by separators by @jarvis-drakon in #544
• fix(access-control): #542 isolate SECRET and unknown sensitivity labels like RESTRICTED by @jarvis-drakon in #545
• fix(recall): #507 frame per-prompt recall as untrusted data by @jarvis-drakon in #531
• fix(action-guard): #517 expand file-reading command substitutions in place by @jarvis-drakon in #548
• fix(session-lease): #550 security-config needs a write shape; hook re-enters the spawning runtime's lease by @jarvis-drakon in #552
• docs(credential-leak): #543 invisible separators are a formatting risk, not proof of intent by @jarvis-drakon in #546
• chore(guard): ADR-002 measurement harness — logged-signal policy comparison + synthetic effect fixtures by @jarvis-drakon in #559
• fix(doctor): #517 enforce with no denial-capable sink is a FAIL, not a WARN (enforcement state unchanged) by @jarvis-drakon in #558
• chore(guard): #559 follow-up nits — README suites, retry-event-mismatch bucket, schema prose by @jarvis-drakon in #560
• docs(architecture): ADR-002 v2 — provenance-first enforcement (session taint, broad floor, measured narrowing) by @jarvis-drakon in #557
• chore(release): v5.1.0 by @TARSDrakon in #562

Full Changelog: v5.0.7...v5.1.0