release: promote v0.5.8 to main

[mohanagy]

Refs #350.

Promotes protected development commit e2f08fa to main for v0.5.8.

Release gate

• package.json and package-lock.json are finalized at 0.5.8
• included work landed through Make upstream startup failures actionable #348, Refresh compatible dependencies #349, test(windows): stabilize ACL probe budget #353, chore(release): prepare v0.5.8 #351, fix(cli): preserve redaction across test-profile failures #357, test(windows): separate ACL probe startup budget #358, fix(cli): preserve retry command arguments #359, and test(cli): run diagnostic output contracts on Windows #360
• chore(release): prepare v0.5.8 #351 passed the full Node 20/22/24 Linux, macOS, and Windows matrix, Linux quality, Verify, CodeRabbit, and independent review at its exact head
• fix(cli): preserve redaction across test-profile failures #357 restored configured-secret redaction across every test-profile failure path and added timeout/signal diagnostic regressions; its full protected matrix and independent review passed
• test(windows): separate ACL probe startup budget #358 separated hosted-runner PowerShell bootstrap scheduling from bounded ACL execution; all 14 Windows ACL contracts passed on Node 20/22/24 while the hanging-probe bound remained about 5 seconds
• fix(cli): preserve retry command arguments #359 makes displayed diagnostic commands exact across POSIX shells and Windows PowerShell and shares the platform-aware quoting contract
• test(cli): run diagnostic output contracts on Windows #360 places the diagnostic argv contract in the protected CLI gate; real POSIX execution and PowerShell execution on Windows Node 20/22/24 passed, along with package and smoke contracts
• Vitest 4 and TypeScript 7 remain excluded because they do not pass current release gates
• npm latest remains 0.5.7 before this promotion

Security impact

• actionable startup details remain bounded and pass through the configured runtime redactor before stderr
• dynamic config paths and profile names remain literal shell arguments, including expansion syntax and apostrophes
• production ACL behavior, credential handling, fail-closed boundaries, and publishing workflows are unchanged
• no registry token or workstation publish is used

Publishing boundary

This PR does not publish. After merge, GitHub Release v0.5.8 must target the exact current main commit. The protected Publish workflow will verify tag, package version, main identity, tests, and package contents, then publish with provenance; registry provenance is verified afterward.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 859eb905-4206-4c84-bfde-2dd3ebce8cd8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

Independent exact-head release review: PASS

Reviewed promotion head e2f08fa against main b076110 on 2026-08-09.

• Standards review: PASS. No material code, release-process, security, or claim defect.
• Spec review: PASS. Package and lockfile are 0.5.8; changelog and patch rationale match Release v0.5.8 #350; npm latest remains 0.5.7; Release v0.5.8 #350 remains open for post-publication evidence.
• Cross-platform contract: test(cli): run diagnostic output contracts on Windows #360 places the real argv suite in protected test:cli, with PowerShell execution passing on Windows Node 20, 22, and 24.
• Exact-head CI: runs 31323766935 and 31323768983 both completed successfully, including Linux quality, the full Ubuntu/macOS/Windows Node 20/22/24 matrix, and Verify.
• Publishing boundary: the corrected exact-main/tag and post-publish provenance wording matches the protected trusted-publishing workflow.

Verdict: approved for the development-to-main release promotion. No material blockers remain.

This comment records the independent agent review evidence required by the release protocol. GitHub cannot accept a formal Approve review submitted by the pull-request author account.