v0.4.8

What's Changed

• [test-improver] Improve tests for config.EffectiveContainerRuntimeCommand by @github-actions[bot] in #10375
• rust-guard: add apply_tool_labels tests for PR review write tools and legacy aliases by @lpcox with @Copilot in #10407
• testify: typed-nil comments, bound asserters in config stdin tests, AGENTS.md docs by @lpcox with @Copilot in #10408
• [log] Add debug logging to tracing/config_resolver.go by @github-actions[bot] in #10374
• [Repo Assist] test(rust-guard): add tests for PR review write tools and legacy aliases by @github-actions[bot] in #10401
• docs: fix documentation discrepancies from nightly reconciliation report by @lpcox with @Copilot in #10409
• docs: fix DOCKER_API_VERSION attribution in CONTRIBUTING.md by @lpcox with @Copilot in #10417
• [test-improver] Improve tests for sys/Docker by @github-actions[bot] in #10419
• [test] Add tests for launcher.GetOrLaunchForSession and config.EffectiveContainerRuntimeCommand by @github-actions[bot] in #10406
• [Repo Assist] refactor(server): add rejectHMAC wrapper to reduce 8-arg repetition in HMAC middleware by @github-actions[bot] in #10461
• [test] Add tests for difc.FilterAndConvertLabeledData by @github-actions[bot] in #10471
• refactor(config): replace hardcoded "docker" literals with DefaultContainerRuntime constant by @lpcox with @Copilot in #10475
• Prevent private secrecy taint for public-scope repo reads when visibility lookup is unknown by @lpcox with @Copilot in #10472
• rust-guard: remove org-scope clone in tool labeling and add private list_releases secrecy coverage by @lpcox with @Copilot in #10473
• Improve jq filter parse diagnostics with gojq ParseError details by @lpcox with @Copilot in #10474
• Refactor server validation failure paths to remove duplicated logValidationFail boilerplate by @lpcox with @Copilot in #10476
• Add targeted contract coverage for rejectHMAC in HMAC middleware by @lpcox with @Copilot in #10477
• Upgrade gh-aw extension to v0.84.1 pre-release and recompile workflows by @lpcox in #10490
• [test-improver] Improve tests for isDirectStdioCommand by @github-actions[bot] in #10510
• [log] Add debug logging to config/error_format.go by @github-actions[bot] in #10509
• [Repo Assist] fix(guard): add coverage for rebuild_codespace and update_codespace_port_visibility by @github-actions[bot] in #10533
• [log] Add debug logging to auth header helper functions by @github-actions[bot] in #10546
• [test-improver] Improve tests for httputil by @github-actions[bot] in #10547
• Codify the shared response-writer wrapper pattern by @lpcox with @Copilot in #10585
• [log] Add debug logging to internal/githubhttp/rate_limit.go by @github-actions[bot] in #10586
• [test-improver] Improve tests for mcp connection package by @github-actions[bot] in #10587
• [Repo Assist] Centralize duplicated repo-private fallback expressions in rust-guard by @github-actions[bot] in #10614
• Harden gojq walk_schema single-output contract and document jq binding safety by @lpcox with @Copilot in #10625
• rust-guard: centralize repo-visibility fallback semantics in labeling helpers by @lpcox with @Copilot in #10624
• Allow integrity audit access to public Actions logs and artifacts by @lpcox with @Copilot in #10626
• [Repo Assist] refactor(rust-guard): downscope wrapper predicates + dedupe search-variant matching by @github-actions[bot] in #10670
• [test-improver] Improve tests for internal/cmd (registerGuardsModeFlag) by @github-actions[bot] in #10646
• [log] Add debug logging to internal/jqutil/secure.go by @github-actions[bot] in #10645
• Test rejection of unknown top-level TOML fields by @lpcox with @Copilot in #10684

Full Changelog: v0.4.7...v0.4.8