v0.128.0

What's Changed

• chore(roadmap): drop the Windows-signing item — #1689 closed as not planned by @mabry1985 in #2408
• fix(plugins): plugin views fail loudly when the DS kit is missing — no bearer-less fallback by @mabry1985 in #2409
• chore(web): retire the bridged legacy CSS-var names — --pl-* tokens everywhere by @mabry1985 in #2414
• feat(prompts): system-prompt viewer P3 — section diffs, subagent capture, true preview by @mabry1985 in #2415
• fix: make Windows shell and desktop paths native by @mabry1985 in #2416
• ci: PR-time Windows-native test job (#2412 phase 3) by @mabry1985 in #2419
• fix(desktop): bundle the console build into the sidecar — /app is real by @mabry1985 in #2423
• feat(infra): one process-tree lifecycle — infra/proc (ADR 0098, #2412 phase 2) by @mabry1985 in #2424
• feat(acp): migrate delegate teardown onto infra.proc (ADR 0098, #2412 phase 2) by @mabry1985 in #2425
• fix(soul): history stamps are strictly increasing — the Windows clock-tie prune bug by @mabry1985 in #2426
• fix(plugins): make wheel installs Windows-safe by @RomeoRaven in #2422
• feat(fleet,cli): migrate member/server lifecycle onto infra.proc (ADR 0098, #2412 phase 2) by @mabry1985 in #2427
• fix(observability): metrics writes can't be starved — in-process write lock + busy-first pragmas by @mabry1985 in #2429
• feat(security): Windows secrets-privacy contract — icacls harden + portable asserts (#2412 phase 4) by @mabry1985 in #2431
• fix(plugins): accept Windows drive-absolute local paths as install sources by @mabry1985 in #2433
• fix(watches,goals): os.replace stores + platform-shell verifiers — Windows batch 2 by @mabry1985 in #2434
• fix(desktop): graceful-first Windows uninstall — the sidecar sweeps its own _MEI tree by @mabry1985 in #2430

New Contributors

• @RomeoRaven made their first contribution in #2422

Full Changelog: v0.127.0...v0.128.0