v0.1.0-alpha.247

What's Changed

• chore(deps): bump @types/node from 25.9.1 to 25.9.2 in /packages/admin by @dependabot[bot] in #1617
• chore(deps): bump vitest from 4.1.7 to 4.1.8 in /packages/admin by @dependabot[bot] in #1618
• chore(deps): bump happy-dom from 20.9.0 to 20.10.2 in /packages/admin by @dependabot[bot] in #1619
• chore(deps): bump @vue/test-utils from 2.4.10 to 2.4.11 in /packages/admin by @dependabot[bot] in #1620
• chore(deps): bump nuxt from 4.4.6 to 4.4.7 in /packages/admin by @dependabot[bot] in #1621
• chore(deps): bump tar from 7.5.15 to 7.5.16 in /packages/admin by @dependabot[bot] in #1671
• chore(deps): bump launch-editor from 2.13.2 to 2.14.1 in /packages/admin by @dependabot[bot] in #1672
• chore(deps): bump js-yaml from 4.1.1 to 4.2.0 in /packages/admin by @dependabot[bot] in #1673
• chore(deps): bump ws from 8.20.1 to 8.21.0 in /packages/admin by @dependabot[bot] in #1674
• chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #1701
• chore(admin-surface): update pre-built SPA dist by @github-actions[bot] in #1679
• fix(release): exactly-once Packagist publish + forward-only releases (WP01) by @jonesrussell in #1720
• fix(graphql): reject mutations over GET — CSRF (WP03) by @jonesrussell in #1721
• WP04 seo: hex-escape JSON-LD <script> output to prevent breakout XSS by @jonesrussell in #1722
• WP05 search: enforce per-document view access in the FTS5 read path by @jonesrussell in #1723
• WP06 relationship: fail-closed related-entity visibility + wire consumers by @jonesrussell in #1724
• WP07 listing: key per-row-filtered cache per acting account by @jonesrussell in #1725
• WP08 engagement: cascade view from parent + honor comment moderation by @jonesrussell in #1726
• WP09 notification: carry the real notification through the queue (async renders all channels) by @jonesrussell in #1727
• WP10 scheduler: portable upsert + durable lock keyed off database availability by @jonesrussell in #1728
• WP11 oauth-provider: check isSuccess() in GitHub getUserProfile (no degenerate identity) by @jonesrussell in #1729
• WP12a install-closure: declare deps + require-parity test, fix structured-import DI, attachment fields by @jonesrussell in #1730
• WP12b: break the user(L1)→ssr(L6) upward layer violation via a container Twig service by @jonesrussell in #1731
• WP13 field: guard PurgeJob against legal-hold + wire role_clearance config by @jonesrussell in #1732
• fix(release): skeleton owned by one workflow + its own Packagist crawl by @jonesrussell in #1733

Full Changelog: v0.1.0-alpha.245...v0.1.0-alpha.247