v0.4.9

What's Changed

• [test-improver] Improve tests for proxy TLS certificate generation by @github-actions[bot] in #10693
• [log] Add debug logging to IsSingularReadTool in tool_policy.go by @github-actions[bot] in #10692
• [Repo Assist] Fix circuit breaker wedging permanently in HALF-OPEN after transport-error probe by @github-actions[bot] in #10719
• Harden Rust guard visibility logging tests by @lpcox with @Copilot in #10733
• Add regression coverage for pull_request_read DIFC labeling by @lpcox with @Copilot in #10735
• Upgrade MCP Go SDK to v1.7.0 by @lpcox with @Copilot in #10734
• [Repo Assist] fix(logger): sanitize secrets in file/server log lines by @github-actions[bot] in #10774
• [log] Add debug logging to guard_visibility.go by @github-actions[bot] in #10749
• 🔄 chore: bump pinned gh-aw schema URL to v0.84.3 by @github-actions[bot] in #10759
• Upgrade golang.org/x/text to v0.40.0 by @lpcox with @Copilot in #10783
• Deduplicate Rust guard repository secrecy logic by @lpcox with @Copilot in #10782
• Retry late HTTP backend registration by @lpcox in #10784
• Upgrade gh-aw extension to latest pre-release and recompile workflows by @lpcox in #10831
• [test-improver] Improve tests for internal/util TruncateRunes by @github-actions[bot] in #10793
• [log] Add debug logging to internal/testutil/mcptest/server.go by @github-actions[bot] in #10837
• [Repo Assist] refactor(rust-guard): dedup owner/repo split logic, use label constants in tests by @github-actions[bot] in #10866
• 🔄 chore: update pinned gh-aw schema URL to v0.85.4 by @github-actions[bot] in #10857
• Recompile all workflows with latest gh-aw pre-release by @lpcox in #10877
• Bump github.com/santhosh-tekuri/jsonschema/v6 to v6.0.3 by @lpcox with @Copilot in #10874
• Preserve public secrecy labels for unknown Actions repo visibility by @lpcox with @Copilot in #10873
• Add regression tests locking in DIFC coverage for 8 previously-flagged GitHub MCP tools by @lpcox with @Copilot in #10875
• Fix Go network access for test coverage workflow by @lpcox in #10892
• [test-improver] Improve tests for httputil by @github-actions[bot] in #10895
• Repo Assist: allow Go module/toolchain domains in workflow firewall policy by @lpcox with @Copilot in #10925
• Enforce a trusted host-path mount policy before launching container MCP servers by @lpcox with @Copilot in #10928
• [test] Add tests for mcp.Connection.callTool by @github-actions[bot] in #10937
• Fix release workflow timeout and gating failures by @lpcox in #10944

Full Changelog: v0.4.8...v0.4.9