v0.3.18

What's Changed

• fix: keep hotfixes out of active release bundles by @metasession-dev in #434
• fix: restrict E2E fan-out to executed requirement tags by @metasession-dev in #436
• fix: bound post-merge E2E regression evidence by @metasession-dev in #446
• fix: preserve E2E timeout lifecycle outcome by @metasession-dev in #448
• fix: diagnose bounded host deployment status by @metasession-dev in #449
• fix: separate deployment eligibility from verification by @metasession-dev in #450
• fix: add verified Railway deployment reconciliation by @metasession-dev in #451
• fix(release): preserve tracked bundle ownership by @metasession-dev in #453
• release: promote Track A deployment recovery contracts by @metasession-dev in #455
• fix(ci): handle check-run auto merge events safely by @metasession-dev in #456
• fix(ci): promote Auto Merge check-run handling by @metasession-dev in #457
• [hotfix] release: bump packages to v0.3.18 by @metasession-dev in #458
• fix(ci): checkout default branch for Auto Merge helper by @metasession-dev in #462

Full Changelog: v0.3.17...v0.3.18