Agent Sidecar v0.4.1

[0.4.1] - 2026-08-24

Added

• MIT licensing, contribution and security policies, issue and pull-request
  templates, and versioned repository ruleset declarations.
• A canonical local quality runner with Ruff, full tests, coverage policy,
  deterministic packaging smoke tests, CLI checks, and skill checks.
• GitHub Actions CI across the supported Python range, scheduled
  cross-platform regression runs, CodeQL analysis, and Dependabot updates.
• A guarded tag release workflow that verifies version and ancestry, builds
  and cross-platform checks the deterministic zipapp, publishes checksums, and
  attests build provenance.
• Complete English and Simplified Chinese user manuals with installation,
  support, uninstall, security, development, FAQ, release, website, and license
  guidance.

Changed

• Centralized branch, pull-request, changelog, review, and dual-track
  main/release procedures in the contribution guide.
• Expanded package metadata and project links while preserving Python 3.9+
  compatibility and an explicit zero-runtime-dependency contract.
• Made bilingual README heading order, command examples, options, and links a
  required governance contract.
• Hardened CI and weekly regression behavior with stable status contexts,
  bounded jobs, explicit platform allowances, and release-compatible checks.

Fixed

• Made daemon stop wait for owned runtime paths and the target process to
  disappear, preventing stale sockets and incomplete shutdown reporting.
• Kept runtime executable validation fail-closed on identity or permission
  changes without rejecting harmless metadata churn in shared ancestors.

Security

• Added private vulnerability-reporting guidance, supported-version policy,
  trust boundaries, and requirements for sanitizing diagnostics.
• Pinned third-party workflow actions to full commit SHAs, reduced workflow
  permissions, and added bounded concurrency and timeouts.
• Bound release publication to immutable version tags, a CI-green main
  ancestry, a fast-forward-only stable release pointer, checksum verification,
  and provenance attestation.