Release v4.8.1 — Windows watch/refresh path fix

Patch off v4.8.0 containing only the Windows-only fix for maki watch
and maki refresh <path>: strip_prefix yields backslash separators on
Windows, which never matched the catalog's forward-slash-normalized
relative_path, so watch treated changed recipes/variants as new files
and path-mode refresh found nothing. Normalized to forward slashes at
the three lookup sites (cherry-pick of f97d91a; the 4.9.0 reversibility
work on main is deliberately NOT included).

Tests: 920+257 standard, 1052+299 pro (v4.8.0 counts + fix).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Release v4.8.0 — Horizon 2 completion: watch, auto-stack, embedded wr…

…ite-back

Workflow features built on v4.7.0's foundations:

- maki watch: poll-based auto-import on filesystem changes, with a
  two-scan size+mtime debounce so files still being copied are never
  half-imported; [watch] config; --once for scripting
- maki auto-stack (Pro): similarity clustering over SigLIP embeddings
  (union-find on top-K neighbour edges), deterministic pick selection,
  report-first with --apply
- maki writeback --embed (Pro): write rating/label/description/tags
  into the embedded XMP of JPEG variants — trash-preserved originals,
  temp-write + verify + atomic rename, content-hash identity migration
  proven doctor-clean. JPEG/XMP v1; TIFF + IPTC IIM + EXIF IFD deferred
- web: provenance badges on machine-added tag chips; -person: honored
  in all web search paths; -collection: honored in export-zip

No schema migration. Tests: 920+257+7 standard, 1052+299+7 pro.

See CHANGELOG.md for the full breakdown and operator notes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Release v4.7.0 — Horizon 2 core: provenance, FTS5, XMP rework, unifie…

…d search

Foundation-rework release fixing the roots behind MAKI's longest bug
sagas, plus a new data-model capability:

- Tag provenance (schema v10): tags record user / xmp-import /
  auto-tag / vlm origin; `tag clear --source`, show annotations;
  machine-tag replacement is now possible
- FTS5 trigram free-text index (schema v9): index-accelerated
  substring search, LIKE-identical semantics, trigger-maintained
- XMP writer rework: regex string surgery → quick-xml
  locate-and-splice; new property-test suite found and fixed three
  real quote-escaping bugs (a label like `19" rack` corrupted the
  whole sidecar). Unblocks IPTC/EXIF embedded write-back
- Unified search filter resolution: the 3 drifted copies (CLI / web /
  export-zip) collapsed to one implementation with every historical
  difference an explicit, documented parameter

Tests: 891+255+7 standard, 1012+289+7 pro.

See CHANGELOG.md for the full breakdown and operator notes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

fix(trash): forward-slash restore keys on Windows

Trash::list built relative paths via strip_prefix + to_string_lossy,
which yields backslashes on Windows — breaking the
<date>/<volume>/<relative-path> restore-key contract that
Trash::restore parses on '/' (and failing the list test in Windows
CI). Normalize to forward slashes, matching the sidecar path
convention used everywhere else.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Release v4.5.17 — XMP writeback hardening + status polish + import dr…

…y-run

Twelve-commit bundle accumulated over the v4.5.17 cycle. Two
threads:

1. XMP writeback hardening (closes the runaway-escape thread
   started in v4.5.14). `xml_unescape` on the regex-based read
   paths stops escape escalation; new `--force` flag rebuilds the
   tag blocks from catalog state for guaranteed-clean writes;
   `update_hierarchical_subjects` no longer filters leaf-only
   entries out of the remove list so legacy `Bavaria` / `Konzert`
   / multi-escape leftovers actually get evicted.

2. `maki status` polish. Per-volume pending-writeback breakdown,
   missing-previews + missing-smart-previews counts, alignment
   fix on the `→ maki <command>` action hints.

Plus the import dialog finally treats dry-run as a first-class
job (progress, re-attach, minimize-to-toast) and the CI Linux
runner stops dying on disk-space pressure.

Tests: 822 + 252 standard, 942 + 286 pro (+9 lib / +2 CLI standard
/ +2 CLI pro from v4.5.16).

See CHANGELOG.md for the full per-feature breakdown and the
commit trail.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Cargo.lock: sync maki version to 4.5.16

Follow-up to v4.5.16 — the version field in Cargo.lock had drifted
to 4.5.15 because the v4.5.15 release commit didn't include a
Cargo.lock update. The next `cargo build` on a fresh checkout
regenerates it; this commit pins the lock file in sync with the
tag so the working tree stays clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Release v4.5.15 — XMP roundtrip cleanup follow-on

Three related fixes surfaced by real-world testing of v4.5.14:

1. insert_recipe now preserves pending_writeback.
   The INSERT OR REPLACE omitted that column; the schema default
   (NOT NULL DEFAULT 0) kicked in on every catalog write and
   silently reset SQLite's pending flag while YAML still said true.
   Symptom: `maki writeback --asset <id>` reports "0 written" while
   YAML has pending=true, web UI shows no pending indicator, edits
   never make it to disk. Add the column to insert_recipe's column
   list so state survives every catalog write.

2. Sidecar-wins gate extended to reimport_metadata_inner.
   v4.5.14 added the gate to the two refresh.rs loops but missed
   the third copy of the iterate-JPEG-locations-and-read-embedded-
   XMP pattern in query.rs — the path behind `maki refresh
   --reimport` and the web UI's "Reload metadata" button. Without
   the gate, that path re-injected the JPEG's stale flat keywords
   just like the unfixed refresh path. Docstring on
   `Catalog::asset_has_recipe` now lists all three known call sites.

3. maki writeback --force flag (and web Maintain checkbox).
   Escape hatch for cases where catalog pending state is wrong or
   when re-canonicalising existing sidecars after an XMP-normaliser
   upgrade like v4.5.14's namespace-URI handling. Distinct from
   --all: --all expands scope to every recipe in the catalog;
   --force keeps the explicit scope (--asset/query/--volume) but
   ignores the pending-flag filter.

Operator note: if upgrading from pre-v4.5.15 with already-diverged
state, run `maki rebuild-catalog --asset <id>` once to re-sync
SQLite from YAML, OR use `maki writeback --asset <id> --force` to
push catalog state to disk regardless of pending flags.

Tests: 813 + 252 standard, 933 + 285 pro (+1 lib / +1 CLI standard
/ +2 CLI pro).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Release v4.5.14 — XMP roundtrip cleanup

Closes two paths that let non-hierarchical tags reappear in the
catalog after a clean writeback.

1. Namespace-URI-aware hierarchicalSubject writeback.
   `lr:hierarchicalSubject` and `lightroom:hierarchicalSubject`
   are the same XMP field (both bound to the Adobe Lightroom
   namespace URI). MAKI's writer previously matched the literal
   prefix `lr:` only — it patched its own block while a parallel
   `lightroom:` block lingered intact. The reader (already prefix-
   agnostic via `local_name()`) then absorbed both on the next
   refresh, with the legacy block's flat-leaf entries leaking back
   into `asset.tags`. Writer now scans xmlns declarations for every
   prefix bound to the Lightroom namespace, builds a dynamic regex,
   and canonicalises the file to a single `lr:` block.

2. Sidecar-wins precedence on `refresh --media`. `refresh --media`
   used to feed every JPEG/TIFF variant's embedded XMP through the
   add-only `reapply_xmp_data`. Since writeback never patches
   embedded XMP, the JPEG's keywords were frozen at import time
   and re-injected on every refresh. New `Catalog::asset_has_recipe`
   gate: if the asset has an `.xmp` sidecar recipe, embedded-XMP
   re-extraction is skipped. The sidecar is authoritative.

Tests: 812 + 251 standard, 932 + 283 pro (+6 lib / +1 CLI per build).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Release v4.5.13 — VLM model guide refresh + Gemma 4 family

Release v4.5.12 — tag-data hygiene + browse selection safety