v0.54.0

What's Changed

• chore(oss): 移除误入公开仓的敏感路径并合入 oss-check 门禁体系 by @frankiehot-tech in #302
• fix(gate-quality): trust_engine_v2 类型注解用 TYPE_CHECKING 导入 by @frankiehot-tech in #307
• chore(oss): 发布门禁闭源清单补强 — 纯闭源目录整目录拦截 + 混合目录精确文件（宪法 11.4） by @frankiehot-tech in #349
• chore(oss): 闭源清单自动补全 — sync-exclude 文件条目精确路径 by @frankiehot-tech in #350
• feat(oss): 深水区资产关键词内容扫描接入（宪法第十一条 11.1） by @frankiehot-tech in #351
• docs(llm): LLM/agent readability — llms.txt + README dual-track + pyproject keywords by @frankiehot-tech in #352
• docs(seo): ai-faq.json (GEO FAQ asset) + README version bump to v0.50.0 by @frankiehot-tech in #355
• fix(ci): repair ci.yml YAML syntax error that disabled main CI + refresh STATE.yaml by @frankiehot-tech in #356
• style(format): ruff format 334 files — clear format backlog blocking CI lint by @frankiehot-tech in #357
• fix(types): resolve mypy 60 type errors across 18 modules by @frankiehot-tech in #358
• feat(ci): add dual-repo-watch workflow for Athena heartbeat monitoring by @frankiehot-tech in #361
• fix(ci): stabilize test job green — git history + env probe mocks by @frankiehot-tech in #359
• fix(ci): provide HMAC key for dast-scan maref serve startup by @frankiehot-tech in #362
• fix(ci): provide MCP secret key for dast-scan maref serve startup by @frankiehot-tech in #363
• fix(ci): enable codeql config and exclude tests from static analysis by @frankiehot-tech in #364
• fix(ci): isolate coverage gate to governance only via -o addopts by @frankiehot-tech in #365

Full Changelog: v0.49.0...v0.54.0