v3.10.7: Learning integrity & supply-chain hardening

What's New

A learning-integrity and supply-chain release.

Fixed — self-learning that was silently stopping

• Hooks no longer drop learning in silence. A wrong-platform better-sqlite3 binary (e.g. a macOS build inside a Linux container) used to fail to open the learning database with zero trace — quietly dropping every captured experience for days. Fatal native failures are now written to a durable .agentic-qe/hooks-health.log so the problem is visible immediately.
• Reward feedback now actually trains. Bumped @ruvector/sona to 0.1.7, fixing an upstream bug where reward feedback produced zero weight changes (and negative feedback failed to "unlearn"). AQE drives that path on every reinforced run, so learning signals were effectively inert before this.

Added — supply-chain safety

• Consumer-side audit gate. CI now packs the tarball, installs it into a clean consumer project, and audits from the consumer's perspective on every dependency-affecting PR and push to main — catching override-masked vulnerabilities before they reach main, not just at publish.

Changed — evaluation suite on current models

• The QE skill evaluation matrix moved off retired model IDs to claude-sonnet-4-6 + claude-haiku-4-5, with claude-opus-4-8 as a capability ceiling for the high-stakes security / chaos / defect skills (across all distribution copies and the eval schema/templates).

Getting Started

```bash
npx agentic-qe init --auto
```

See the CHANGELOG and release notes for full details.