Release v3.11.1

CI infrastructure fix only — no application code changes.

- ci(release): native arm64 runners + split-build manifest pattern
  Fixes the QEMU emulation timeout that cancelled v3.10.0 and v3.11.0
  Docker release builds at the 6h GitHub Actions ceiling. arm64 now runs
  on ubuntu-24.04-arm natively (no QEMU); pandas/lxml C-extension compile
  goes from >6h to ~15min.
- ci(release): drop pre-built otel variant
  Niche use case. Build with --build-arg ENABLE_OTEL=true if needed.
- ci(release): per-job timeout-minutes (5–90) for fast failure surfacing.
- ci(release): provenance: false to skip buildx attestation overhead.

Application code identical to v3.11.0.

Release v3.11.0

See merge commit c4bf2ed for full changelog (27 commits).

Highlights:
- feat(tools/shell): runtime-reloadable global shell deny-groups via config.tools
- feat: native image_generation for Codex + OpenAI-compat (nextlevelbuilder#1002)
- feat(codex-pool): per-modality round-robin counter (nextlevelbuilder#1021)
- feat(pancake): TikTok (nextlevelbuilder#990) + Shopee (nextlevelbuilder#975) sub-platform support
- feat(vault): chat_id isolation for isolated teams
- feat(pipeline): session compaction overflow recovery (nextlevelbuilder#958)
- feat(tools): send_file + team-root cross-chat read access
- fix(tools/read_audio): transcription routing for openai_compat + fail-fast on missing creds
- fix(tools): scope credentialed-CLI blocked-command wording to [CREDENTIALED EXEC] marker
- fix(discord): allowlist-gate regression
- refactor: adopt Go 1.26+ standard library modernizations

v3.10.0 — TTS expansion: per-provider params, agent override, voice p…

…icker UX

Merge remote-tracking branch 'origin/main' into dev

feat(channels): shared WriterLabel helper with prompt-injection sanit…

…ization

feat(pancake): auto-react allow/deny scope filter + UI toggle

Extends nextlevelbuilder#919 with per-channel scope control for Facebook auto-react.

- AutoReactOptions pointer struct (allow/deny post & user IDs)
- filterAutoReact + containsString helpers; deny overrides allow
- UI surfaces features.auto_react toggle + 4 tags fields
- Nil options = react-all (backward compatible)

feat(pancake): auto-react allow/deny scope filter + UI toggle

Extends nextlevelbuilder#919 with per-channel scope control for Facebook auto-react.

- AutoReactOptions pointer struct (allow/deny post & user IDs)
- filterAutoReact + containsString helpers; deny overrides allow
- UI surfaces features.auto_react toggle + 4 tags fields
- Nil options = react-all (backward compatible)

feat(channels): TTS auto-apply for Discord/Telegram/WhatsApp + UI enh…

…ancements

Backend:
- Add TTS auto-apply support to Discord, Telegram, WhatsApp channels
- Improve text processing for TTS strip markdown
- Wire TTS config handler to gateway server

UI:
- Add voice recorder hook for chat input
- Add agent hooks tab with summary card
- Update i18n for agents (en/vi/zh)
- Minor CSP and credential section fixes

feat(agent): inject TTS [[tts]] directive guidance when auto mode is …

…"tagged"

- Add TTSAutoMode field to LoopConfig, Loop, SystemPromptConfig
- Wire from config.Tts.Auto through resolver to system prompt
- Inject "## Voice Response" section explaining [[tts]] usage
- Update AGENTS.md: voice only when user explicitly requests

fix(ui): TTS page UX improvements and CSP fix for audio playback

- Add media-src 'self' blob: to CSP for TTS audio blob URLs
- Show advanced config section expanded by default
- Add Save button in credentials section
- Show Voice/Playground sections only after credentials saved
- Improve voice picker message when API key not saved yet
- Add Vite proxy timeout for large audio responses