v0.5.3

Security

• req_llm ~> 1.29 (was ~> 1.26): req_llm 1.9.0 through 1.28.0 did
  not verify TLS certificates on wss:// WebSocket sessions (OpenAI
  Responses, Realtime and Codex WebSocket modes), exposing the API key or
  OAuth token to an on-path attacker
  (GHSA-6vww-5m28-f26v).
  rho never selects those transports (streaming stays on SSE over Finch,
  which verifies certificates), so rho was not exposed; the bump keeps
  hosts from resolving an affected req_llm.