chore: release v0.5.0 (#11)

Headline changes since v0.4.0:

- New ch4p gui app — Electron-style desktop UI with native chat,
  gateway auto-start, themed selects, live terminal, and persisted
  state. Replaces the previous web-only canvas as the default GUI
  surface (apps/gui).
- Server tsconfig wired into the typecheck script so apps/gui's
  server tree is no longer a blind spot.
- eslint now backstops noUnusedLocals/noUnusedParameters in test
  files (each package's tsconfig excludes **/*.test.ts, so tsc never
  saw them). 29 unused-local findings cleaned up across the tree.
- Security audit tests no longer use os.tmpdir() — on Linux that
  resolves to /tmp, which is now in PREFIX_DANGEROUS_WORKSPACES, so
  the workspace check failed in CI but passed on macOS. Tests now
  use node_modules/.cache/ch4p-test-tmp.
- vite override raised to ^7.3.2 to clear three vitest>vite vulns
  that the previous scoped overrides did not reach.
- Test count: 2642 → 2711.

chore: bump version to v0.4.0

Progressive streaming, memory persistence on all exit paths, and
AbortSignal listener cleanup — see GitHub release notes for details.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat(soul): support ~/.ch4p/soul.md for personal identity customization

Users can now create a soul.md file to customize their ch4p's personality
and behavior. The file is automatically loaded at startup and appended to
the system prompt across all entry points (gateway, canvas, agent CLI).

Zero config — just create the file and it works.

Also bumps version to v0.3.10.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: bump version to v0.3.9

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: bump version to v0.3.8

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore(release): v0.3.7

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore(release): v0.3.6

Bump all 19 package.json files from 0.3.5 to 0.3.6.
Update SVG header version badge to v0.3.6.
Update README test badge to 2536 (88 test files).

Security hardening shipped in 3724d2b:
- Request body size limit (1 MB)
- Per-IP token-bucket rate limiting (30 burst, 5/s refill)
- CORS restricted to localhost + configured origins
- Cryptographic nonce generation for x402 payments
- Nonce replay protection in x402 server middleware
- Timing-safe MAC comparison for Zalo webhook verification
- MCP command allowlist validation before spawn
- Stronger PBKDF2 key derivation for encrypted secrets
- Gateway config enum validation (thinkingLevel, autonomy, logLevel)
- x402 startup warning when verifyPayment is unconfigured

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore(release): v0.3.5

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore(release): v0.3.4

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore(release): v0.3.3

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>