v0.18.7 — phone approvals and closed bypasses

chore(release): re-cut v0.18.6 on main to include #590 and #591 (#592)

The tag moves from 0b2bd64 to this commit so the release carries the Tk
dialog distill (#590) and the lazy schema migration (#591). Their fragments
fold into the compiled v0.18.6 section; the version was already 0.18.6.

Merge pull request #509 from DobermanCore/chore/release/v0.18.5

chore(release): v0.18.5 — retention, self-awareness, and a tighter bar for tutorials

chore(release): v0.18.4 — friction reduction, part three; telemetry o…

…n by default (#485)

Merge pull request #466 from DobermanCore/chore/release/0.18.2

chore(release): v0.18.2 — friction-reduction patch

chore(release): 0.18.1 — README images render on PyPI (#383)

chore(release): 0.18.0 — security-audit wave (output-scan coverage, a…

…uth-state + Windows-separator control-plane) (#381)

chore(release): bump to 0.17.1 (#287)

chore(release): v0.17.0 (#217)

feat(egress): raise-only static egress classification (EB.1), release…

… v0.16.0

EB.1 — the single slice of the egress-breakout defense plan (v4). The MCP proxy now parses the RAW shell/package/git command (a lossless walk_command) and surfaces external_destination, so a network reach hidden inside a shell_exec / package_install / git_op is visible to the guardrails instead of slipping past as an opaque command.

- secret + command egress = BLOCK (the existing secret-exfil floor now fires)
- command egress + one egress_ambiguous signal (dynamic host, route/proxy override, unbalanced quoting, 256-char cap, multi-host) -> AUTH via ExternalDestinationRule
- NormalizationFailureRule turns a parser crash into a fail-closed objective floor
- command egress excluded from the subjective baseline (can't be slow-boiled to familiar); secret-shaped host labels HMAC-redacted before the SecurityObject

Strictly raise-only: never a new PASS, never a lowered verdict.

Release prep: __version__ single-sourced from package metadata (no more drift); version bumped 0.15.0 -> 0.16.0 for the PyPI release.

Closes EB.1. EB.2/EB.3 deferred, EB.1b/EB.4 cut (plan v4 / ADR 0039).