chore(release): v0.18.1

[arantespp]

Patch release 0.18.0 → 0.18.1, cut with pnpm lerna version patch --yes --no-push.

Included changes

Two fixes landed on main since v0.18.0:

• fix(webhooks,triggers): encrypt signing secrets at rest (fix(webhooks,triggers): encrypt signing secrets at rest #793)
• fix(workflows): reject an automation transition with no recorded cause (fix(workflows): reject an automation transition with no recorded cause #792)

docs: mark knowledge Phase 6 (injection hardening) as shipped (#794) is also in the range but is a docs: commit, so it does not appear in the changelog and does not affect the bump. Two fix: commits and no feat:/breaking commits, so conventional-commits resolves to a patch.

What this bumps

All six workspace packages 0.18.0 → 0.18.1: @soat/cli, @soat/sdk, @soat/server, plus the private @soat/app, @soat/postgresdb, @soat/website.

Notes

• Tags were fetched before running lerna, so the changelog range is v0.18.0...v0.18.1 with no duplicated entries.
• The engines relaxation needed to run lerna under Node 22 / pnpm 11.5 in this environment was reverted and amended out — package.json is byte-identical to main, verified with git diff origin/main HEAD -- package.json.
• The local tag lerna created was deleted after the amend, since it pointed at the pre-amend commit. push-release-tag in main.yml creates the real v0.18.1 tag from the merged commit.

Merge

Squash merge, keeping a commit subject that starts with chore(release):. Every job in main.yml re-checks startsWith(head_commit.message, 'chore(release):'), so a default merge commit titled Merge pull request #NNN… would silently skip the tag push, the npm publish, and the Docker image build while still showing green.

---

Generated by Claude Code

[github-actions]

Deploy Outputs

Package	Stack	Output Key	Output Value
@soat/website	SoatWebsite-claude-soat-release-patch-sk593b	BucketWebsiteURL	http://soatwebsite-claude-soat-release-patch-staticbucket-jenxkotpbwff.s3-website-us-east-1.amazonaws.com