v5.328.2

What's Changed

• fix(#4140): make durationMs test deterministic — drop wall-clock margin by @griffinwork40 in #4144
• fix(#3796): advisory findings from 2026-10-14 PR triage batch by @griffinwork40 in #4002
• fix(#4120): move duplicated normalizeSlotProvider/parseStringField into model-slots.utils.ts by @griffinwork40 in #4143
• fix(#4139): pin agent-tool error strings, fix DAG isolation test name, add Invariant comment, fix stale docstring by @griffinwork40 in #4148
• fix(#4141): SSRF host guard, timeout tests, botInfo fail-closed by @griffinwork40 in #4145
• ci: remove the auto-release workflow; releases are manual by @griffinwork40 in #4146

Full Changelog: v5.328.1...v5.328.2