v0.38.6

Highlights

• Plan-20260916 GS-23 registers [github_sync]. Root and nested
  whitelist, restart-required reload classification, commented sample in
  config/config.toml and config init, bilingual README links.
  (plan-20260916 GS-23.)

User-visible changes

• Unknown [github_sync] keys now fail config validate.
• Changing any github_sync field on reload is restart-required.
• config init and config/config.toml share the same commented sample.
• README.md and README.zh.md link docs/refactoring/github-sync.md.

Compatibility

• Patch bump 0.38.5 → 0.38.6.
• Default remains enabled = false. No semantic gates yet (GS-04 / GS-13).
• No SSH, vault resolve, or outbound push.

Verification

• cargo +nightly fmt --all --check
• cargo clippy --all-targets --all-features -- -D warnings
• source .env.test && cargo test --all
• cargo build and cargo build --tests
• Codex GS-23 R3 VERDICT: PASS
• Claude GS-23 R2 VERDICT: PASS

Known limitations

• enabled = true is still accepted until GS-04 / GS-13 add fail-closed checks.