docs(changelog): fold pending notes into 0.28.0 + document migration

[elkaix]

Why

The judge subagent, default-prompt redesign, and the read-only-profile network + git config-injection (RCE) guards merged to main in #43 — but their CHANGELOG entries were left under ## Unreleased, while ## 0.28.0 (2026-05-31) already existed (scripts/release.py promoted it during the release-prep run). v0.28.0 is not yet tagged (latest release is v0.27.0), so nothing wrong has shipped — but tagging it as-is would publish a curated changelog that omits a user-facing behavior change and a security fix that are already on main and ship in 0.28.0.

What

• CHANGELOG.md + docs/en/release-notes/changelog.md — move the two stranded entries into the ## 0.28.0 section as narrative bullets matching the existing ### What changed in this release style, and add a judge subagent / prompt-redesign bullet. Both lockstep files updated identically. The root ## Unreleased body is now empty (intentional).
• Security bullet tightened — now covers not just network clients but the git -c/--config-env/--exec-path config-injection block (arbitrary command execution via core.pager/core.sshCommand), which the original wording missed.
• breaking-changes.md — the ## 0.28.0 entry no longer says "No breaking changes"; it documents the .pythinker/AGENTS.md-no-longer-loaded change with scoped migration guidance ("action only if you used it").
• tests/test_installation_docs.py — drop the now-stale integrations.md entry from the old-owner guard's skip_files (its old-owner reference was removed in docs: remove dead Zsh plugin integration #44) and the matching zsh-pythinker-code comment token. The guard now scans integrations.md and passes.

Review note

The breaking-changes.md 0.28.0 entry flips from "No breaking changes" to documenting one. This is deliberate — dropping .pythinker/AGENTS.md loading silently changes behavior for anyone who relied on it (the test_load_agents_md.py change in #43 confirms a real loader change), and the changelog already provides migration steps. If you consider it too minor to flag as breaking, revert just that hunk.

Validation

• pytest tests/test_installation_docs.py tests/test_release_py.py → 29 passed
• All three changelog files keep exactly one ## Unreleased anchor; ## 0.28.0 ( heading intact
• ruff check + ruff format --check clean on the touched test
• No src/**/packages/**/installer paths touched → changelog-entry-required is exempt by design

Summary by CodeRabbit

• New Features

  • Introduced judge subagent

• Breaking Changes

  • .pythinker/AGENTS.md is no longer loaded as project instructions; relocate affected instructions to root or directory-level AGENTS.md files

• Security

  • Enhanced read-only subagent profile restrictions to block network operations and unsafe git configuration options

• Documentation

  • Updated release notes with judge subagent details and breaking change guidance
  • Redesigned default agent, plan, and system prompts

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR consolidates release notes for version 0.28.0 by moving .pythinker/AGENTS.md instruction loading removal, a new judge subagent, and read-only subagent security restrictions from the Unreleased section into the 0.28.0 changelog. Breaking-changes.md is updated to document the migration path. The regression test's skip list removes integrations.md.

Changes

Release Notes Consolidation and Regression Test Update

Layer / File(s)	Summary
Release notes reorganization for 0.28.0 CHANGELOG.md, docs/en/release-notes/breaking-changes.md, docs/en/release-notes/changelog.md	Entries for .pythinker/AGENTS.md loading removal, judge subagent, and read-only subagent restrictions are moved from Unreleased to 0.28.0 release notes. Breaking-changes.md documents migration guidance for instructions moved out of .pythinker/AGENTS.md.
Regression test skip list update tests/test_installation_docs.py	integrations.md is removed from the repo-owner-references regression test skip list and will now be actively scanned for legacy references.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• Pythoughts-labs/pythinker-code#43: The main PR's changelog/docs updates mirror the same 0.28.0 behavioral changes from #43—stopping .pythinker/AGENTS.md instruction loading, adding the judge subagent, and tightening read-only subagent shell/network/git guards—so they're directly aligned.

Suggested labels

documentation

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows conventional commits format (docs(changelog):) and accurately describes the main changes: consolidating pending changelog notes into the 0.28.0 release section and documenting the migration impact.
Description check	✅ Passed	Description covers all critical areas: motivation (incomplete 0.28.0 changelog before tagging), detailed changes to each file, security tightening specifics, deliberate design choices, and validation results.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 70.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/fold-0.28.0-changelog-notes

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/en/release-notes/changelog.md`:
- Around line 32-34: The changelog in docs/en/release-notes/changelog.md has
been manually edited but is auto-synced from the root CHANGELOG.md; revert your
manual changes in docs/en/release-notes/changelog.md, make the intended edits in
the root CHANGELOG.md instead, and then run the repository's changelog sync
script (the changelog sync flow) to regenerate
docs/en/release-notes/changelog.md so the release notes are updated correctly
and won't be overwritten.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0033e9f3-9f5d-423c-9733-1280de55e767

📥 Commits

Reviewing files that changed from the base of the PR and between 6d6f2f7 and b2bf98a.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/en/release-notes/breaking-changes.md
• docs/en/release-notes/changelog.md
• tests/test_installation_docs.py