v0.26.0

Added

• Add the Prime Agent harness: run agro harness install prime-agent to install Prime Agent 0.10.0 in the sandbox (#1500).

Changed

• Run a task from one plan approval to a ready PR: /prd opens the issue, writes prd.json, and opens the draft PR, then /delegate runs the task lifecycle up to the operator merge (#1512).
• Stop re-running CI on main pushes, gate releases on the reusable CI: Harness workflow, run optional-harness installs after merge, and cap each CI job with timeout-minutes (#1504).
• Run each read-only CI job on the CI_RUNNER runner, and keep the job HOME in login shells on Blacksmith runners so the CLI install smokes pass there (#1507).
• Add git-maintenance.sh push-delete <remote> <branch> so agents delete merged remote branches without turning off cc-safety-net; the verb refuses development, main, and master (#1510).

Fixed

• Make the agro shell failure hint suggest agro restart <name> so a stopped sandbox restarts instead of a new sandbox being created (#1516).

Security

• Raise the undici override to ^7.30.1 to clear GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, and GHSA-f72v-6w45-q472 (#1504).
• Run Python provisioning as the sandbox user at container start and remove the root /usr/local/bin/gateway link to agent-writable code; use agro gateway (#1516).