v0.10.7

What's Changed

• Add Copilot CLI Tier 1 parity roadmap by @omkhar in #264
• Polish Copilot CLI roadmap docs after review by @omkhar in #266
• ^B Fix four silent error-swallow correctness bugs (sethify findings) by @omkhar in #267
• ^B+^F Security hygiene: TOCTOU fixes, O_NOFOLLOW, GOOS gating, curl caps, mutable banner (sethify findings) by @omkhar in #269
• ^R Dead code & idiom cleanup: runLauncherCompat, git-launcher.rs, stdlib swaps (sethify findings) by @omkhar in #270
• ^R Refactor: adapter table collapse + authpolicy flag-parser dedup (sethify findings) by @omkhar in #271
• ^D Docs/naming fixes: --ui, mode map, Copilot status, package docs (sethify findings) by @omkhar in #272
• ^F+^R CI/CD hygiene: validator cache scope + strict bash + PR pin gate (sethify findings) by @omkhar in #268
• ^F Unify git-config blocklist via policy/ TOML + parity check (closes #275) by @omkhar in #277
• ^R Collapse metadatautil sub-packages into parent (closes #276) by @omkhar in #278
• ^R Split god-files: extract Path, staging.go, bootstrap.go (sethify followup) by @omkhar in #280
• ^R Extract shared PolicySource type into internal/injectionpolicy (closes #274) by @omkhar in #279
• ^B Revert defaults block from scorecard.yml (main-CI fix) by @omkhar in #281
• chore: bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #265
• chore: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/markdownlint in the npm_and_yarn group across 1 directory by @dependabot[bot] in #263
• Fix upstream refresh and bootstrap network resilience by @omkhar in #283
• Keep Debian refreshes bootstrap-buildable by @omkhar in #284
• Harden runtime build retry recovery by @omkhar in #285
• Preserve refresh publication validation by @omkhar in #286
• Refresh pinned upstreams by @omkhar in #287
• Harden GitHub API redirect authentication by @omkhar in #288
• Add repository readiness gate by @omkhar in #289
• Refresh pinned upstreams by @omkhar in #290
• Remove dead code: unused exit1, ptyNameBufferSize, redundant loop copy by @omkhar in #291
• Dedup metadatautil/injection helpers; drop unused param by @omkhar in #292
• providerid: derive IsValid from AllProviders; single package doc by @omkhar in #293
• Dedup config-home path; reuse scenarios key helpers by @omkhar in #294
• hostutil: extract parseSessionRootsSingle for single-id session helpers by @omkhar in #295
• publishpr: extract resolveAgainstWorkspace from resolve helpers by @omkhar in #297
• Remove dead bash helpers (shasum precondition, workcell_die, reject_if_protected_provider_path) by @omkhar in #296
• public-node-guard: compute isProtectedProviderFile once in maybeBlock by @omkhar in #298
• check-repo-readiness: fetch tracker issue list once by @omkhar in #299
• trusted-docker-client: dedup duplicated registry CA blocks by @omkhar in #300
• runtime wrappers: hoist shared env pin/sanitize into runtime-user.sh by @omkhar in #301
• execveat: reuse classify_loader_target / loader_targets_mutable_native_exec by @omkhar in #302
• colima-timeout harness: extract assert_contains for forwarded-arg checks by @omkhar in #303
• execveat: rustfmt the loader_targets_mutable_native_exec assignment by @omkhar in #304

Full Changelog: v0.10.6...v0.10.7