v0.5.1

What's Changed

• security: strip the injected obfuscated payload from website scripts by @jtrefon in #198
• website: gate npm audit with a named, self-expiring exception by @jtrefon in #199
• website: derive smoke-test routes from the built artifact by @jtrefon in #200
• refactor: burn the size gates to zero, and gate complexity by @jtrefon in #197
• chore: stop tracking python bytecode caches by @jtrefon in #201
• build: make the size gates fail closed, and give them tests by @jtrefon in #202
• build: gate control-flow nesting, and gate debt markers by @jtrefon in #203
• build: enforce patch coverage, and publish a gate report as a build artefact by @jtrefon in #204
• build: render the gate report and coverage numbers on the run page by @jtrefon in #205
• build: gate the hygiene rules AGENTS.md states but nothing enforced by @jtrefon in #207
• build: pin clang-format, the last analyzer still tracking the runner image by @jtrefon in #206
• fix: exclude bench/scenarios from the complexity and nesting gates by @jtrefon in #208
• refactor: burn down the four functions sitting at the NLOC cap by @jtrefon in #209
• refactor: burn down the worst remaining NLOC/CCN offenders by @jtrefon in #210
• refactor: burn down four more, including two dispatch tables by @jtrefon in #211
• refactor: burn down the four functions sitting at the CCN cap by @jtrefon in #212
• refactor: clear the CCN >= 14 tier entirely by @jtrefon in #213
• ci: close two fail-opens found by mutation testing the gates by @jtrefon in #214
• test: fuzz the three parsers that consume untrusted bytes by @jtrefon in #215
• test: make the cancellation test deterministic; CCN cap 15 -> 14 by @jtrefon in #216
• ci: scan for committed secrets; pin and check vendored md4c by @jtrefon in #217
• docs: record the two risks that cannot be closed, and why by @jtrefon in #218
• build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #219
• build: a clean build now emits nothing at all by @jtrefon in #220
• docs: proposal for the outstanding backlog, with two corrections by @jtrefon in #221
• docs: proposal for reaching spotless state, with the real axis named by @jtrefon in #222
• docs: sealed pipeline proposal, and why a green build was not clean by @jtrefon in #223
• docs: main is red, and the merge rule that would have caught it by @jtrefon in #224
• website: except the source-map-js advisory, unblocking the Pages deploy by @jtrefon in #225
• tui: fix model search and drawer selection; ship the TUI's link deps by @jtrefon in #226
• website: bump sharp to 0.35.5 for the librsvg advisory by @jtrefon in #228
• docs: proposal for a provider-aware model picker by @jtrefon in #230
• tui: expose the provider, and list every configured provider's models by @jtrefon in #231
• build(deps): bump the npm_and_yarn group across 1 directory with 3 updates by @dependabot[bot] in #229
• tui: provider tabs, honest token status, and a usable API-key field by @jtrefon in #232
• fix: /set model lists every configured provider's cached catalogue by @jtrefon in #233
• tui: /set model provider tabs filter the rows by @jtrefon in #234
• tui: the tab arrows stay the drawer's, and only the active tab is highlighted by @jtrefon in #235
• lib: a picked model's provider reaches the window agent (bar and routing agree) by @jtrefon in #236
• release: bump version to 0.5.1 by @jtrefon in #237

Full Changelog: v0.3.0...v0.5.1