Keep session Git watches host-owned

What's Changed

• Route every session Git watch read and mutation through the owning mthost or mtagenthost before updating the server-side watcher projection.
• Preserve multi-repository watch sets across tlbx restarts and full runtime updates, including migration of legacy Agent Controller metadata into mtagenthost.
• Restore Git subscriptions for every visible session after frontend reloads.
• Refresh vulnerable transitive frontend tooling dependencies in the application and screenshot automation lockfiles.

Release integrity

Native archives have matching platform-specific SPDX SBOM assets plus GitHub build-provenance and SBOM attestations. Installers and the built-in updater additionally verify a signed manifest and all packaged-file hashes.

Verification guide · Security policy