agent-bom v0.93.5

What's Changed

• chore(deps): consolidate weekly dependency and registry updates by @msaad00 in #3600
• feat(ui): guided demo lock cards on runtime surfaces (Part of #3468) by @msaad00 in #3602
• feat(output): svg/html formatter convergence (Part of #2918) by @msaad00 in #3601
• feat(ui,deploy): /login + collector mTLS defaults (Part of #3175) by @msaad00 in #3603
• refactor(parsers): extract skill metadata checks into skill_audit_metadata by @andres-linero in #3604
• refactor(api): split postgres_store into per-store modules by @andres-linero in #3605
• feat(ui): rollup-by-default and asset drift lens (Part of #3192) by @msaad00 in #3606
• feat(ast,output): PHP/Swift symbol reach and Parquet export (Part of #3499) by @msaad00 in #3607
• docs(audit): consolidate epic queue merge state (#3601–#3607) by @msaad00 in #3611
• feat(runtime): OIDC discovery shim for legacy IdP MCP interop (Part of #3609) by @msaad00 in #3612
• feat(findings): runtime evidence + compliance moat lift (Part of #3608, #3610) by @msaad00 in #3613
• fix(scan,output): CLI AST gate + Parquet compliance_tags parity (audit P1/P2) by @msaad00 in #3614
• feat(runtime): trace explorer joined to findings and compliance (Part of #3608) by @msaad00 in #3615
• feat(ui,graph): runtime evidence overlay badges (Part of #3610) by @msaad00 in #3616
• feat(proof): release smoke, demo estate, trust doc, proof-path nav (#3618) by @msaad00 in #3619
• docs(deploy): unified install script, quickstart, and intake diagrams by @msaad00 in #3621
• fix(audit): P3 login redirect, Swift bare calls, rollup URL persistence by @msaad00 in #3622
• feat(scan,docs): GLM/Zhipu inventory + BYOM quickstart (closes #3609 tail) by @msaad00 in #3623
• fix(audit): malicious findings stream, COUNT cache, demo hardening, SCIM keys by @msaad00 in #3624
• fix(ui): capture hydration + refreshed product-proof screenshots by @msaad00 in #3625
• fix(audit): post-3624 follow-up — reachability, demo safety, scale bench by @msaad00 in #3626
• chore(release): v0.93.5 by @msaad00 in #3628
• fix(pre-release): CI isolation, README SVGs, and UI readability by @msaad00 in #3629
• fix(audit): SARIF malware flag on CVE path + PHP heredoc/nowdoc reach masking by @msaad00 in #3630

Full Changelog: v0.93.0...v0.93.5