chore(master): release 0.5.0

[github-actions]

🤖 I have created a release beep boop

0.5.0 (2026-08-05)

Features

• evidence: represent GSTR JSON artifacts in filed-return live evidence (#110) (54479aa)

Fixes

• download: bind portal blob capture and cancellation to the Pack action (#112) (22ae918)
• gst: bind filed-return acquisition to the requested target (#96) (bf10bf3)
• gst: restore returns dashboard and GSTR-2B download (#125) (32a92e7)
• injection: make MAIN-world functions self-contained across the executeScript boundary (#116) (20e7422)
• recovery: keep unproven artifact outcomes in review (#106) (c3c98ea)
• recovery: reconcile a cancelled target from exact download evidence (#113) (b7447bb)
• recovery: reconcile a completed acquisition checkpoint after worker death (#117) (61b63fd)
• recovery: retain acquisition checkpoints (#126) (93171b4)

Documentation

• agent: align reviewed manifest boundaries (#82) (818ebf7)
• agents: record that the PR body is gated and where its contract lives (#114) (ff95027)
• privacy: disclose full-year ZIP correlation fields and retained JSON bytes (#105) (4fbdd78)
• readiness: add full-year recovery QA matrix (#132) (9cd0737)
• readiness: clarify full-year recovery matrix (#134) (114b80a)
• store: refresh v0.4.0 listing assets (#83) (c7d306e)

Tests

• release: cover release-please API contract (#133) (155fd54)

Maintenance

• deps-dev: bump prettier from 3.9.4 to 3.9.6 (#89) (28204b3)
• deps-dev: bump typescript-eslint from 8.63.0 to 8.65.0 (#88) (a92babd)
• deps: bump actions/checkout from 7.0.0 to 7.0.1 (#86) (4d4bb4e)
• deps: bump actions/setup-node from 6.4.0 to 7.0.0 (#87) (3b8492e)
• deps: remediate high severity audit findings (#94) (ae38ce8)

---

Pack Workflow Preflight

• Generated by Release Please. pnpm workflow:preflight runs in Review findings gate.

Privacy And Data-Flow Impact

• Release metadata only; no extension runtime, browser permission, host permission, network, credential, GST file, taxpayer-data, analytics, or telemetry behavior changes are introduced by this generated PR.

Sensitive Surface Review

• Release metadata only; no current-tab targeting, portal target binding, download completion, service-worker durability, local path, raw URL/referrer, or portal HTML behavior is changed by this generated PR.

Verification

• Pack CI and Review findings gate are required for the latest PR head.
• Release ZIP and provenance will be produced by the Pack Release workflow after the release PR merges.

PR Review Follow-Up

• Autogenerated review comments and inline review threads should be inspected before merging.
• Follow-up release hardening remains separate from this generated Release Please PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa83846c14

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Align public source-version claims

With this bump, the canonical source version becomes 0.4.1, but the public status/readiness copy still says the repository source has advanced only to v0.4.0 (README.md:47, docs/PUBLICATION_READINESS.md:29). Because those pages distinguish source releases from Store-published evidence, shipping the release with stale source-version claims makes the public release status false until the claims are updated or narrowed.

AGENTS.md reference: AGENTS.md:L49-L53

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8d69f7f489

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Align public source-version claims with 0.5.0

When this release PR lands, the canonical package/runtime version becomes 0.5.0, but the public status copy still says the repository source has advanced only to v0.4.0 (README.md:47, docs/PUBLICATION_READINESS.md:29). Fresh evidence since the earlier review comment is that this diff now bumps the canonical version to 0.5.0, so those source/readiness claims remain false until they are updated or narrowed.

AGENTS.md reference: AGENTS.md:L49-L53

Useful? React with 👍 / 👎.