Orca v0.4.32

What's Changed

• ci(windows): isolate resource-sensitive contracts by @echoVic in #112
• fix(tui): gate the HashMap import behind the test/debug cfg (#58) by @echoVic in #86
• fix(exec): deliver the prompt byte-exact and reject a blank argument (#66) by @echoVic in #87
• fix(protocol): keep the request id when params fail to deserialize (#78) by @echoVic in #88
• fix(protocol): deliver the bare-string input shorthand on turn/start (#77) by @echoVic in #89
• fix(server): a failed request must not terminate the JSONL server (#79) by @echoVic in #90
• fix(acp): report malformed client params as -32602, not -32603 (#80) by @echoVic in #91
• fix(acp): report a client-declined permission as refusal, not Internal error (#76) by @echoVic in #92
• fix(workflow): resolve workflow source against --cwd and the active Orca home (#85) by @echoVic in #93
• fix(workflow): restart commands resolve provider credentials like the launch path (#83) by @echoVic in #94
• fix(workflow): re-run a failed agent when its continuation is gone (#84) by @echoVic in #95
• fix(provider): retry every 5xx, not a fixed allow-list (#68) by @echoVic in #96
• fix(workflow): resolve scripts independently of the launcher cwd, and surface worker failures (#82) by @echoVic in #97
• fix(trust): key folder trust by an existence-independent canonical path (#75) by @echoVic in #98
• fix(shell): guard workspace executables with the configured workspace (#71) by @echoVic in #100
• fix(shell): keep the invoked name of a symlinked shell (BusyBox) (#70) by @echoVic in #101
• fix(runtime): explain an untrusted workspace instead of failing with 'Read-only file system' (#73) by @echoVic in #103
• fix(sandbox): probe bwrap even when the workspace root is an ancestor of it (#69) by @echoVic in #102
• fix(server): report a refused permission grant instead of 'request is no longer active' (#74) by @echoVic in #104
• fix(terminal-bench): pass the instruction after -- by @echoVic in #106
• fix(terminal-bench): make the install step survive slow images by @echoVic in #108
• docs(terminal-bench): quarantine the unscorable qemu-startup task by @echoVic in #110
• fix(runtime): rename a provider tool call whose id the session already used by @echoVic in #111
• docs: add Pilion Browser integration section by @echoVic in #113
• fix(trust): serialize trust-store writes across processes (#81) by @echoVic in #99
• fix(terminal-bench): persist the trajectory on failed and timed-out runs by @echoVic in #107
• fix(terminal-bench): expose the model-latency lever and record usage by @echoVic in #109
• fix(runtime): cancel headless runs on SIGINT/SIGTERM instead of dying by @echoVic in #105

Full Changelog: v0.4.31...v0.4.32