- **`bun run readme`**: new `scripts/readme.ts` generates or refreshes `README.md` for every publishable package using the script agent. Supports `--upgrade` (regenerate existing), `--dry-run`, and `--package <name>` filters. The agent is scoped per-package so it can only read that package's source.

- **`agentQuery()` helper** (`scripts/util.ts`): Mastra-based agent loop that can call tools (`list_files`, `read_files`, `git_status`, `git_diff`, `git_log`, `execute_typescript`) to inspect the repo on demand before answering. Replaces `aiQuery()` for prompts that benefit from multi-step reasoning over source files.

- **`getScriptAgent()`**: lazily builds and memoizes a Mastra `Agent` backed by Databricks Model Serving. Filesystem tools are sandboxed to a configurable `cwd`; `.cursor/rules/*.mdc` conventions are injected into the system prompt automatically.

- **`tag.ts` switched to `agentQuery()`**: release-notes generation now uses the tool-calling agent instead of a one-shot `aiQuery()` call, letting the LLM inspect touched files via `read_files` / `git_diff` when the diff stat alone is insufficient.

- **Sandboxed `execute_typescript` tool**: runs code in `oven/bun:1` via Docker/Podman with `--network=none`, dropped capabilities, memory/CPU limits, and a 10s timeout. Omitted silently when no container runtime is available.

- **Git tools for the agent**: `git_status`, `git_diff`, `git_log` wrappers scoped to the repo root, each with optional path filters. Omitted when `git` is not on PATH.

- **New root devDependencies**: `@mastra/core`, `execa`, `zod` (catalog).