v2.3.5

Added

• team: hmd team auto — GitHub zero-touch join/initiate; secret path is fallback
• presence: first-run auto-team via GitHub (replaces solo-mint; W3 client)
• cp: cp_autoteam — POST /team/auto zero-touch join/initiate (W2, oracle 21/21)
• cp: cp_ghverify — server-side gh identity + repo-access strata (W1 of auto-team)
• cp: cp_repoteam — server-side repo->team registry (W1 of auto-team)

Fixed

• god: fall back to plain identity token for user accounts (--audiences fails)

Tests

• oracle: INV-AUTOTEAM — gate zero-touch auto-team-formation (AT1-AT5)

Maintenance

• release: v2.3.5

Full changelog: v2.3.4...v2.3.5

Install/upgrade:

curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.3.5/install.sh | bash

install.sh.minisig is the detached minisign signature of this release's install.sh; bin/heimdall-autoupdate verifies it against release/heimdall-signing.pub before applying.