v0.18.5

Changed

• Refresh public metric copy from the 2026-09-18 production
  public-marketing-metrics-v1 report (262,201 jobs, 5,486 companies, rounded
  down to 250K+ jobs and 5,400+ companies) across package.json,
  server.json, and the README.
• Make the MCP Registry remote header note OAuth-first: leave it blank to sign
  in with OAuth; the trk_ API key is optional for headless clients.
• README: add the hosted Claude Code OAuth command, state tool counts precisely
  (58 local stdio tools, 55 hosted tools: the hosted server omits 4 local-only
  tools and adds trackly_chat), link the hosted connector page, and point the
  Claude Code manual config at a project .mcp.json.
• Record that the plugin submission needs no UserInfo endpoint because trackly
  does not use workspace domain restrictions.

Fixed

• Omit generated lockfiles from the Claude review inline copy before the 100 KB
  cap so source hunks are not truncated out of the trusted window. A review that
  dropped lockfiles stays PARTIAL; lockfile-only PRs are packed from the raw
  lockfile diff. Terminal-record grammar is unchanged.

• Pack complete files into that same 100 KB window, preferring scripts over
  tests, instead of mid-file truncation. Skipped files stay PARTIAL. A rejected
  terminal result now logs reconstructable shape flags without publishing it.

• Quote the taught Partial LGTM line in the opaque/packed review NOTE, and log
  rejected terminal-record lines from the last standalone header, so a
  fail-closed publish can be reconstructed without loosening the extractor
  grammar.

• Recover a complete Claude terminal review when the model wraps the taught
  metadata or clean-verdict lines in inline code, or prefixes the required
  header with planning text. Issue autolinks, trailing prose, and incomplete
  last results still fail closed.