Oxyn v0.0.4

What's Changed

• fix(query): classify server-side copy targets as writes by @so-keyldzn in #164
• fix(desktop): require native confirmation for row samples by @so-keyldzn in #165
• fix(desktop): order keychain writes around declaration saves by @so-keyldzn in #169
• docs(ci): align quality gate documentation with main ruleset by @so-keyldzn in #163
• fix: integrate the remaining 2026-10-03 security-audit fixes by @so-keyldzn in #171
• fix(desktop): guard external agent declarations through host confirm by @so-keyldzn in #161
• fix(llm): enforce local socket reach and redact endpoint secrets by @so-keyldzn in #162
• fix(ai): store external agent tokens in the system keychain by @so-keyldzn in #166
• fix(postgres): require verified tls outside local by @so-keyldzn in #167
• fix(ci): enforce dependency checks and verify pinned tools by @so-keyldzn in #168
• fix(query): redact sql passwords before persistence by @so-keyldzn in #170
• build: release 0.0.4 by @so-keyldzn in #172

Full Changelog: v0.0.3...v0.0.4