v3.2.0

What's Changed

• feat(TC-893): replication harness S0 — contracts and skeleton by @samgbafa in #470
• feat(TC-893): replication harness S3a — runner and leg reports by @samgbafa in #472
• feat(TC-893): replication harness S1 — Docker topology runner by @samgbafa in #473
• feat(TC-893): replication harness S3b — gate logic by @samgbafa in #474
• feat(TC-893): replication harness S5 — workflow and README by @samgbafa in #476
• feat(TC-893): replication harness S2 — clients by @samgbafa in #475
• feat(TC-893): replication harness S4a — core scenarios 00–05 and runtime assembly by @samgbafa in #477
• feat(TC-893): replication harness S4b — core scenarios 06–11 by @samgbafa in #479
• ci(TC-893): G1 waits for the subject SHA's replica-e2e run by @samgbafa in #482
• fix(TC-893): default the workspace SUT root to the repository root by @samgbafa in #485
• fix(cli,operations): one verified replay policy for stored grants; tc auth grants list/remove (TC-672, TC-673) by @samgbafa in #489
• fix(cli,node-sdk,operations): expired imported sessions ask for sign-in without contacting the node (TC-674) by @samgbafa in #490
• feat: tc secrets request/wait, canonical /request link, secrets.status, ifAbsent (TC-834, TC-832) by @samgbafa in #491
• feat(TC-858): Phase 1 replication read-through flag (CLI + node-sdk), beta by @samgbafa in #484
• chore(release): republish @tinycloud/replica; beta installs fail with ETARGET by @samgbafa in #493
• Fix published SDK loading in replication legs by @samgbafa in #494
• feat(TC-860): @tinycloud/courier package and tc courier (agent-to-agent threads) by @samgbafa in #496
• feat(TC-858): simplify replication prefixes by @samgbafa in #495
• fix(operations): recover same-PID profile locks left by a dead predecessor (TC-670) by @samgbafa in #499
• fix(mcp,node-sdk,operations): complete the hosted MCP connect flow (TC-589) by @samgbafa in #498
• ci(mcp): redeploy a pinned image digest without rebuilding by @samgbafa in #500
• feat(sdk): storage status, one storage.full event, no doomed writes on reads (TC-628) by @samgbafa in #450
• TC-858: enforce replica gzip budget from merge base by @samgbafa in #501
• fix(sdk): type the remaining auth-error producers and narrow message fallbacks (TC-676) by @samgbafa in #497
• ci(mcp): check deploy credentials before any build or deploy by @samgbafa in #502
• feat(courier): wait for OpenKey's pending agents space during init (TC-945) by @samgbafa in #503
• fix(node-sdk): sign bootstrap permissions onto their own space (TC-957) by @samgbafa in #504

Full Changelog: v3.1.0...v3.2.0