v5.2.0

What's Changed

• fix(audit): #547 anchor STEALTH_ONLY_REASON, unbreakable Markdown code span, e2e recall framing + generated hostile fixtures by @jarvis-drakon in #563
• fix(firewall): #566 scheme-less curl/wget targets are external egress by @jarvis-drakon in #567
• fix(doctor): #517 (c) a webhookUrl the notify transport rejects is not a denial-capable sink by @jarvis-drakon in #568
• fix(judge): #538 (1) redact Review Copilot annotations at the persistence boundary + one-time backfill by @jarvis-drakon in #561
• chore(guard): #570 resolve the four disclosed ADR-002 harness limitations (evaluator digest, derived counts, own-target collateral, failure_allowed bucket) by @jarvis-drakon in #571
• fix(recall): frame MCP echo paths that still leak stored text (#535) by @TARSDrakon in #565
• fix(doctor): #569 detect and safely move shadowing Hermes plugin copies by @TARSDrakon in #572
• chore(release): v5.2.0 by @TARSDrakon in #575

Full Changelog: v5.1.0...v5.2.0