v4.3.0

Minor release — 2 features, 1 fix, 1 docs improvement. Headlined by the trust-chain security trigger: the adversarial Security Auditor now auto-fires on any change to the framework's own enforcement layer (.claude/hooks/** + .claude/settings.json), not just auth/crypto/secrets paths.

Added (feat)

• (#777) auto-invoke the Security Auditor on trust-chain changes — fac3547
• (#709) route remaining creator skills + label helper through tracker abstraction — 6f515e3

Fixed (fix)

• (#769) agdr-arch-pr hook — origin-first diff base + raw-command marker haystack — c342be8

Changed (refactor / chore / docs)

• (#756) add star-history chart to README — b98bb28

Closes

• Closes #709, #756, #769, #777

Testing

1. After merge, confirm CI creates tag v4.3.0 on main (the auto-tag-on-release-pr-merge workflow run).
2. Verify git describe --tags --abbrev=0 origin/main returns v4.3.0.
3. Run /release-sync v4.3.0 to sync main→dev and prevent squash divergence.

Refs #779

---

Glossary

Term	Definition
Trust chain	The hooks + settings that decide whether an action (especially a merge) is permitted — the code an attacker most wants to weaken.
Post-sync boundary	The sync: merge main into dev after <ver> commit; the changelog range starts after it so only genuinely-new commits are counted (#737/#749).
Auto-tag	The auto-tag-on-release-pr-merge.yml workflow that tags the squash commit on merge and creates the GitHub Release (AgDR-0076).
Forge-aware	Behaviour that adapts to the git host (GitHub / GitLab) via the tracker abstraction, rather than hardcoding gh.