v0.306.0

Changelog

• 76d92db Fix OAuth token leak on sibling-subdomain redirects
• ba3dd4a Fix Windows command injection when opening auth login URL
• 9a456a8 Fix auth token leak on cross-host API client redirects
• d0168ff Fix credential header leak on cross-domain API redirects
• 7ed8c54 Fix destructive SQL gate bypass via MySQL executable comments
• 082894c Merge main and keep header-stripping on cross-host redirects
• b770362 Omit OAuth client credentials from auth help text
• 6f7cdf3 Remove unused OAuth client flags from auth check
• 0d3d18e Sanitize connection observability fields before terminal output
• 4daaeb4 config: allowlist project .pscale.yml keys to block credential exfil
• 8762d16 d1 import: keep literal comment gofmt-stable
• 67d681a d1 import: omit invalid table foreign keys
• e1bc8c9 d1 import: run injection assertions before optional Postgres skip
• 98507d4 d1 import: stop emitting untrusted DEFAULT/REFERENCES SQL verbatim
• 6bf3a54 d1 import: stop parseTableBody at balanced CREATE TABLE close