Features since v0.52.1:
- Offline TPA scanner + trust-tiered approval modes (spec 086), with the
  security scanner UI and trust-mode controls (spec 088)
- macOS tray glance section: recent calls, connected clients, 24h histogram
- Connect wizard forewarns the macOS App-Data prompt (spec 078 US4)
- Update check: daily cap, failure backoff, CI nudge suppression (spec 079 US3)

Security:
- Landlock domains are per-thread, so the sandbox could exec an untrusted MCP
  server completely unconfined while logging 'Landlock enforced'. The thread is
  now pinned across confinement and execve, with a fail-closed check that
  refuses to exec rather than exec unconfined.

Fixes:
- Session retention no longer evicts live sessions, and no longer skips keys by
  mutating a bucket mid-cursor
- ClearOAuthState collects keys before deleting
- macOS tray detects a dead externally-attached core and recovers from a stale
  socket without ever launching over a live one
- Tray menu now updates while it is open
- D1 retrieval gate pinned to freeze-era upstreams and gated on the exact corpus

Known limitations: #933 (saturated-backlog core), #937 (config-load bypasses the
trust-mode admission gate).