v0.137.0

What's Changed

• feat(chat): pre-publish review + publish client for the hosted viewer (#2682, #2683) by @mabry1985 in #2694
• feat(marketing): collapse prior months on the changelog page by @mabry1985 in #2695
• feat(chat): publish-link revocation + Settings ▸ Publish (#2684) by @mabry1985 in #2696
• feat: boot-phase timing, /perf chat command, durable by-model p99 rollups (#2674, #2677, #2678) by @mabry1985 in #2698
• fix: background job completion doesn't reliably render live in its origin chat tab (#2692) by @mabry1985 in #2699
• feat: extract the bundle bump-pins PR logic into a tested script (#2669) by @mabry1985 in #2700
• feat(telemetry): per-tool execution latency breakdown (#2697) by @mabry1985 in #2701
• test(boot): de-flake the boot-phase timing test on native Windows by @mabry1985 in #2703
• design(marketing): rebuild the site on the shared design system by @mabry1985 in #2702
• fix(telemetry): dedupe tool_calls count by tool-call id (#2705) by @mabry1985 in #2706
• docs(project-manager): nudge toward task() delegation for wide investigation by @mabry1985 in #2712
• feat: fix(auth): distinguish explicit-empty from unset for auth.token and auth.federation_token (#2691) by @mabry1985 in #2704
• feat(tools): read_file pagination + turn-scoped memoization by @mabry1985 in #2709
• fix(plugins): stop claiming a consent confirm that doesn't exist (#2720) by @mabry1985 in #2725
• fix(archetypes): forward requires_tools through the console create seam (#2713) by @mabry1985 in #2726
• fix(plugins): carry per-plugin load failures into the install result (#2716) by @mabry1985 in #2727
• feat(bundles): archetype block soul_preset + unknown-key warning (#2715) by @mabry1985 in #2728
• fix(plugins): CLI uninstall warns when a running server keeps the plugin live (#2717) by @mabry1985 in #2729
• feat(plugins): trust & consent foundation — config + resolution (ADR 0071 D3 S1/S2, #2721) by @mabry1985 in #2733
• feat(bundles): lifecycle past install — update, re-pin, uninstall + the guide (#2718) by @mabry1985 in #2732
• feat(devkit): lifecycle tools — install / update / disable / uninstall / verify (#2719) by @mabry1985 in #2735
• test(bundles): bundle lifecycle smoke — install → enable → seed → use → update → uninstall (#2724) by @mabry1985 in #2736
• fix(setup): wizard parity — bundle Configure step + runtime warning (#2714) by @mabry1985 in #2730
• fix(tools): list_verifiers clarifies core types are operator-only by @mabry1985 in #2745
• fix(plugins): trust-matcher hardening — the 2733/2735 review findings (#2721) by @mabry1985 in #2739
• feat: feat(observability): instrument plugin lifecycle (load/config/register) latency (#2675) by @mabry1985 in #2742
• fix(bundles): lifecycle corrections — the 2732/2736 review findings (#2718) by @mabry1985 in #2740
• fix(devkit): lifecycle-tool fixes — the 2735 review findings (#2719) by @mabry1985 in #2741
• feat(plugins): the one-time "this runs code" consent (ADR 0071 D3 S4–S6, #2721) by @mabry1985 in #2734
• docs(adr): 0027/0071 status amendments — the D3 consent layer shipped (S7) by @mabry1985 in #2752
• feat(console): bundle actions on the Installed tab — Update / Uninstall (#2718) by @mabry1985 in #2737
• feat: ci: add one repo-owned fast gate script shared by local devs and PR CI (#2746) by @mabry1985 in #2751
• feat: feat(observability): instrument knowledge/memory-store op latency (#2676) by @mabry1985 in #2748
• fix(scheduler): a wait() rescheduled mid-fire is silently deleted (#2749) by @mabry1985 in #2750
• fix(a2a): skill seam hardening — validated registration, owned ids, live served card (#2754) by @mabry1985 in #2757
• fix(tools): read_file is line-addressed, search_files gets regex + context (#2755) by @mabry1985 in #2756

Full Changelog: v0.136.0...v0.137.0