Release v2.11.1

- e3d7a86 fix(ui): clear activity frame before repaint
- 580b0a6 feat(ui): show elapsed activity time
- 724fea3 fix(release): honor signing and activity output
- 5f35518 ci(release): run checks as release preflight
- 4383964 fix(release): make exact-SHA recovery reliable — VAL-009
- 6cd2130 fix(linux): harden capability and prompt recovery — VAL-009
- c06b8f8 chore(tooling): enforce final shell allowlist — WI-007
- bc33b01 feat(node): migrate npm publishing orchestration — WI-006
- a60800a feat(ci): migrate release workflows to Go — WI-005
- 22e77a2 test(installer): migrate integration harnesses to Go — WI-004
- b9de601 feat(devtool): migrate development workflows to Go — WI-003
- f58f75f feat(release): migrate local publishing to Go — WI-002
- 97f7207 feat(devtool): add shared Go tooling foundation
- 5415e7c feat(release): show staged validation progress
- 74648bd fix(installer): use portable transaction identity checks
- 729c74b fix(ci): gate releases on cross-platform checks
- b42d459 fix(linux): harden low-port capability lifecycle
- 69f1b63 fix(installer): recover interrupted capability upgrades
- 83f2f3c fix(daemon): apply capability through running executable
- 6cfeb92 fix(upgrade): make Linux replacement transactional
- 7539c20 fix(daemon): pin Linux capability targets
- e66e992 fix(installer): require a usable TTY for prompts
- bd2b714 test(daemon): explain executable fixture permission
- f78cf91 test(daemon): tighten fixture file permissions
- 933948c test(daemon): canonicalize symlink expectation
- bcbfad2 docs: document Linux low-port setup
- 763bad3 test(linux): verify low-port capability isolation
- 718e64e fix(daemon): explain Linux low-port bind failures
- 0892a9b fix(upgrade): preserve Linux low-port access
- 61365c3 fix(installer): preserve Linux low-port access
- 19e00ec feat(daemon): add Linux low-port setup
- b6ba89f style(release): clarify unpublished tag notes
- 1915ddf style(release): separate bump selector instructions
- fd6572b ci(go): track latest security patches
- 5f70d75 fix(distribution): harden install and release checks
- 67fdd83 fix(node): harden client contracts
- 4ac5643 fix(core): harden state and exposure lifecycle-----BEGIN PGP SIGNATURE-----

iJEEABYKADkWIQTI63OTuHNWmmaLdlTrl+Q0TBhI9wUCamXg4RsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwwLDMACgkQ65fkNEwYSPdXzwEA+9O7GDo7VUlBUqtYLq/0
+sCQCDED2eHmYLBptJ77CcgBAMS8ZnGsQ0Bk4fPus5XVywHiHx4lOn0v/6YNO0d+
PD8C
=WKbm
-----END PGP SIGNATURE-----

Release v2.11.0

- c06b8f8 chore(tooling): enforce final shell allowlist — WI-007
- bc33b01 feat(node): migrate npm publishing orchestration — WI-006
- a60800a feat(ci): migrate release workflows to Go — WI-005
- 22e77a2 test(installer): migrate integration harnesses to Go — WI-004
- b9de601 feat(devtool): migrate development workflows to Go — WI-003
- f58f75f feat(release): migrate local publishing to Go — WI-002
- 97f7207 feat(devtool): add shared Go tooling foundation
- 5415e7c feat(release): show staged validation progress
- 74648bd fix(installer): use portable transaction identity checks
- 729c74b fix(ci): gate releases on cross-platform checks
- b42d459 fix(linux): harden low-port capability lifecycle
- 69f1b63 fix(installer): recover interrupted capability upgrades
- 83f2f3c fix(daemon): apply capability through running executable
- 6cfeb92 fix(upgrade): make Linux replacement transactional
- 7539c20 fix(daemon): pin Linux capability targets
- e66e992 fix(installer): require a usable TTY for prompts
- bd2b714 test(daemon): explain executable fixture permission
- f78cf91 test(daemon): tighten fixture file permissions
- 933948c test(daemon): canonicalize symlink expectation
- bcbfad2 docs: document Linux low-port setup
- 763bad3 test(linux): verify low-port capability isolation
- 718e64e fix(daemon): explain Linux low-port bind failures
- 0892a9b fix(upgrade): preserve Linux low-port access
- 61365c3 fix(installer): preserve Linux low-port access
- 19e00ec feat(daemon): add Linux low-port setup
- b6ba89f style(release): clarify unpublished tag notes
- 1915ddf style(release): separate bump selector instructions
- fd6572b ci(go): track latest security patches
- 5f70d75 fix(distribution): harden install and release checks
- 67fdd83 fix(node): harden client contracts
- 4ac5643 fix(core): harden state and exposure lifecycle

Release v2.10.3

- b6ba89f style(release): clarify unpublished tag notes
- 1915ddf style(release): separate bump selector instructions
- fd6572b ci(go): track latest security patches
- 5f70d75 fix(distribution): harden install and release checks
- 67fdd83 fix(node): harden client contracts
- 4ac5643 fix(core): harden state and exposure lifecycle

Release v2.10.2

- 5f70d75 fix(distribution): harden install and release checks
- 67fdd83 fix(node): harden client contracts
- 4ac5643 fix(core): harden state and exposure lifecycle

Release v2.10.1

- edca1e6 fix(node): reject isolated daemon startup

Release v2.10.0

- 93c0558 fix(node): align config discovery boundaries
- c7791f7 fix(up): preserve exposure routes during reload
- df0260f fix(proxy): gate certificate issuance by active routes
- 1e0e082 docs(node): document public API
- 895d062 feat(agent): polish readiness diagnostics

Release v2.9.0

- 059f28f fix(agent): harden automation diagnostics
- e3eb0a9 feat(agent): add automation-ready descriptors

Release v2.8.0

- f6d3161 feat(cli): add route env descriptors

Release v2.7.1

- 94d030c fix(upgrade): keep daemon restart failures recoverable
- 7620140 docs(node): highlight agent automation APIs

Release v2.7.0

- e695619 feat(node): add agent run env APIs