v1.4.1

What's Changed

• Document provision()'s personaLint field and lintPersonaIdentity by @zoharbabin in #30
• fix(prompt-lint): fire persona_name_drift off declared name alone by @zoharbabin in #34
• ci: trigger on merge_group so the merge queue can actually merge by @zoharbabin in #68
• ci: add live-verify gate (real Kaltura API smoke test) by @zoharbabin in #67
• ci: pin actions to SHA, expand SAST/secret gates, gate live-verify on merge queue by @zoharbabin in #69
• ci: DX gates, coverage floors, and CodeQL by @zoharbabin in #70
• docs: fix stale dependabot.yml comment about Actions pinning by @zoharbabin in #71
• Extract shared Teardown helper for subscribe/unsubscribe-on-destroy pattern by @zoharbabin in #72
• Bind a session to a real end-user identity (userId on session creation) by @zoharbabin in #48
• Add ./experience/chroma-key: bring-your-own transparent-background avatar compositor by @zoharbabin in #51
• chroma-key: destroy the compositor on session.disconnect()/stop(), not just 'ended' by @zoharbabin in #73
• docs: document the full sys__* reserved-variable surface (issue #37) by @zoharbabin in #50
• Flag unresolvable reserved-variable references in previewPrompt() (#45) by @zoharbabin in #49
• docs: cross-reference issue #42 on thread hard-delete blocker by @zoharbabin in #54
• docs: document unbounded thread-history growth and per-turn cost by @zoharbabin in #60
• docs: cross-reference issue #44 on thread-summarization blocker by @zoharbabin in #61
• Fix GenUI parse.js quoted-value leak and flush-left dash-list parse failure by @zoharbabin in #63
• GenUI: graded interactive-question widget (issue #39) by @zoharbabin in #52
• docs: GenUI widget-interaction analytics recipe (no double-counting) by @zoharbabin in #55
• docs: pause/resume recipe for video and interactive content (issue #40) by @zoharbabin in #57
• Fix: _coldReconnect() clears paused/_sessionReleased so resume() doesn't spuriously time out by @zoharbabin in #64
• fix(chroma-key): destroy player on mount failure, derive fatal codes from session.js by @zoharbabin in #89
• fix(prompt-lint): detect every unclosed {{, not just the last one by @zoharbabin in #90
• fix(devx): honest verify timeout, exports-derived CDN smoke test, no ghost commands by @zoharbabin in #91
• docs: fix API/wire/GenUI reference drift by @zoharbabin in #92
• fix(experience): hold cold-reconnect approve while paused, release on resume() by @zoharbabin in #93
• docs: fix § 10 cross-reference direction in GENUI-REFERENCE by @zoharbabin in #97
• fix(management): tolerate duplicate categoryEntry link under transport retry by @zoharbabin in #98
• Bump version to 1.4.1 by @zoharbabin in #99

Full Changelog: v1.4.0...v1.4.1