v1.20.21 — Security hardening and multi-worker Prometheus metrics (ADR-089)

Security & maintenance release on top of v1.20.20.

🔒 Security — 43 dependency vulnerabilities resolved (open Dependabot alerts 43 → 0)

• Frontend: next 16.2.7 (incl. CVE-2026-45109), mermaid 11.15, postcss, plus protobufjs/uuid pnpm overrides — lockfile regenerated.
• Backend: langchain-core 1.4.0 (CVE-2026-44843), python-multipart 0.0.30 (CVE-2026-42561), shipped as the coherent LangChain / LangGraph / OpenAI / Anthropic / FastAPI ecosystem upgrade (PR #145).
• Validated: 8438 unit tests; backward-compatible LangGraph checkpoints (no migration); clean real-prod smoke.

📊 Fixed — accurate Prometheus metrics across all workers (ADR-089)

Under uvicorn --workers 4, metrics were served by a single worker, so real-time dashboards under-counted ~4×. Metrics are now aggregated via prometheus_client multiprocess mode (PROMETHEUS_MULTIPROC_DIR, gated on --workers, RAM /dev/shm, non-fatal); the 45 Gauges each carry an explicit multiprocess_mode; five instrumentation fixes (mcp_server_health, lifetime_metrics_error_total Gauge→Counter, channel_active_bindings, registry_size, circuit_breaker). Single-worker dev is unchanged.

🔧 Fixed — frontend Vitest suite green again (test-only mock fix)

No schema change, no migration. New env var: PROMETHEUS_MULTIPROC_DIR (auto-set by the entrypoint with --workers).

Full details: CHANGELOG · ADR-089