v0.5.0

Pull request automation (auto-fix, auto-merge and lifecycle prompts) and
webhook automation conditions. Two breaking changes: every install must
re-approve the plugin's capabilities after upgrading, and Gitea's floor is now
1.27 (stay on 0.4.x for Gitea 1.20 to 1.26). Tested against Forgejo 7, 11, 15
and 17 and Gitea 1.27.

• Pull request automation (#8):
  the plugin's counterpart of Kandev's GitHub CI auto-fix, auto-merge and pull
  request prompts. Per linked pull request, from a new Automation section in the
  review panel:

  • Auto-fix prompts the task's agent with new CI failures, conflicts and
    review feedback, one round at a time, at most 10 rounds. The agent reports
    action_taken, non_actionable or blocked through the pr tool's new
    outcome op.
  • Auto-merge merges once CI has passed, the branch merges cleanly, and
    reviews and required approvals allow it. It is pinned to the head commit it
    checked, and audited.
  • Lifecycle prompts tell the agent when its review is requested, or when
    the pull request is merged or closed.

  Workspace defaults, a "review feedback the agent sees" setting (everyone,
  official reviewers, or none) and the auto-fix prompt are in the integrations
  card. Defaults never turn on auto-fix or auto-merge for a fork, and the plugin
  never starts a fork's agent. See docs/pr-automation.md.

• Breaking: re-approve the plugin's capabilities after upgrading. Pull
  request automation adds api_write: messages, api_read: sessions and the
  turn.completed and task_session.state_changed events. Kandev re-checks
  the whole capability set, so every gated feature (repository picker, review
  panel, watches) is refused until an administrator re-approves in Settings →
  Plugins → Forgejo.

• The watch panels and the automation settings treat a blank workspace routed
  by the host as none and fall back to the active workspace, as the connection
  panel already did. Before, they asked for a workspace instead.

• When the active workspace changes, the watch panels and the automation
  settings no longer keep the previous workspace's list, settings or open
  draft. Before, a watch drafted in one workspace could be saved into another
  with the first one's workflow and column.

• The review panel's checks and the ci tool's commit-status fallback listed
  only the first 30 statuses of a commit with more, and took the overall state
  from those 30 alone. They now read every page.

• The pr agent tool's schema no longer describes title ("required for
  open" is still the answer when it is missing), to make room for outcome
  within the same size budget.

• Automation conditions (#7):
  Forgejo and Gitea webhooks can start a Kandev automation. Three conditions
  appear in the automation editor: a push to a branch, a pull request event
  (opened, reopened, new commits, closed, merged, review requested, commented),
  and the result of a Forgejo Actions run (Forgejo 12+, not Gitea). Each has
  repository, branch, author, label, draft, workflow and fork filters as
  applicable; pull requests and runs from forks are ignored unless a condition
  opts in. Every delivery's HMAC signature is verified and anything unsigned or
  mis-signed is refused. Set up one Forgejo webhook per condition with the URL
  and secret Kandev shows; see docs/automations.md.
  Adds no capability, so there is no re-approval prompt.

• About upgrades from now on: Kandev ties each webhook binding to the
  installed plugin version and to the condition's saved settings. After every
  plugin upgrade or reinstall, and after editing a condition, its webhook
  answers 401 until you click "Configure webhook" again and paste the new secret
  into the Forgejo webhook.

• On a long pull request the review panel shows the newest 50 reviews and
  conversation comments, and its approval count reads the newest 100 reviews.
  It used to read only the first page of reviews, the oldest, and could miss a
  recent verdict.

• Watches serve every workspace. They used to stop at the first 200.

• Release binaries are built with Go 1.26.10, which fixes GO-2026-6809
  (compromised intermediate certificates trusted by crypto/x509).

• Breaking: Gitea's supported floor is now 1.27, its current release (was
  1.20). Gitea supports only its most recent release upstream, and the plugin
  follows it. Plugin 0.4 is the last release line supporting Gitea 1.20 to 1.26:
  on those, install the newest 0.4.x and stay on it. Forgejo's floor stays at 7.
  The plugin now targets recent Forgejo first, and a feature Gitea cannot serve
  may ship for Forgejo only. The README's "Supported versions" table lists each
  feature's minimum release per host.

• CI now tests Forgejo 7, 11, 15 and 17 and Gitea 1.27.