v5.331.0

What's Changed

• feat(rewind): /rewind conversation|files|both with cross-turn file restore (#4271 stage 1) by @griffinwork40 in #4286
• refactor(#4042): stage 3 — model-resolution parity in dispatchDagNode (resolveChildModel) by @griffinwork40 in #4288
• test(#3956): add remote_agent abort-race and lost-connection framing tests by @griffinwork40 in #4296
• feat(web,telegram): web/CLI parity Stages 1-5 (restacked onto main) by @griffinwork40 in #4295
• fix(#3863): remove write-only pending-question-store by @griffinwork40 in #4299
• feat(subagent): child-to-parent yield for foreground subagents by @griffinwork40 in #4297
• fix(#4291): bash lexer long wrapper options, pipe-ampersand, truncated verbs by @griffinwork40 in #4303
• test(#4276): freeze DEFAULT_LSP_CMD and harden abort-test timing by @griffinwork40 in #4302
• fix(#4203): address remaining advisory findings from 2026-10-19 evening triage by @griffinwork40 in #4301
• fix(#2938): enable GitHub security features + CodeQL workflow by @griffinwork40 in #4311

Full Changelog: v5.330.0...v5.331.0