Release 0.5.1: beta promotion candidate

[makeitfutureDev]

Promote the frozen beta candidate df7156b to stable 0.5.1. Package and lockfile specify 0.5.1. The owner explicitly authorized promotion of this candidate on 2026-09-09 after the outstanding live gates were reported: “ok trust me and push it.” This overrides the live-gate prerequisite for this promotion; it does not turn unexecuted cases into passes.

Scope: 76 commits beyond main (210 changed files), including plugin packages through skill sources/review/templates/channel grants, Teams native controls/events/files/voice, portable conversation controls and quoted-session recovery, durable approvals and updater behavior, skill assignment UI, and Slack command/configuration fixes. Plugin development PR: #85; native hook correction: #87. Live testing found the previous candidate silently ignored inline hooks; the corrected compiler uses the native event map.

Validation on the exact candidate:

• Full npm run test:coverage: 2,499 passed, zero failed, 11 opt-in skips; coverage floors passed. Skips do not constitute live acceptance.
• npm run check:static, npm run secret-scan -- --history, and npm run test:security-coverage: passed.
• npm audit --omit=dev --audit-level=high: passed (one moderate advisory remains).
• npm run check:dco -- origin/main..HEAD: passed for all 44 non-merge commits.
• Candidate CI: Node 22.13 and 24, hygiene and DCO passed.
• CG_LIVE_PLUGIN_CONTAINER=1 node --test test/plugin-container.live.test.js: passed compiled Claude manifest validation and stdio MCP echo in a disposable container. This did not exercise conversational engines.
• Plugin QA definitions PLUG-01 through PLUG-04 and partial execution evidence registered in the private QA registry; no full gate PASS claimed.
• Fixed-source real Claude and Codex portable probes read the bundled marker and called the actual namespaced echo MCP successfully. Separate native Claude command/agent sessions returned the expected markers, each with exactly one SessionStart hook line. Disposable containers removed.
• Control-plane API subset on preceding source 2b59005 passed eight malformed-source/recovery cycles, preserving revision bytes/grants and sanitized summaries. The Git HTTP response was fixture-injected; browser and external Git transport remain unexecuted. Full suite reran on df7156b after correcting the real currentRevisionId regression assertion.

Outstanding acceptance evidence (owner-authorized promotion override):

• Execute all applicable live acceptance gates in TEST-PLAN.md on this candidate, including PLUG-01/02/03 for Claude and Codex and PLUG-04 control-plane validation.
• Prior private acceptance campaign was not a release sign-off: it contained blocked/inconclusive cases and covered an older source. The QA browser was rechecked on 2026-09-09 and has no Slack authentication cookie. Interactive login and resolution of the operator-held Teams/Google Chat fixtures are needed before relevant native live cases can run.
• Complete exact-candidate operational/canary and release artifact evidence required by docs/RELEASE-CHECKLIST.md and docs/RELEASE-ACCEPTANCE.md. Historical image/tag attestations do not certify this candidate.
• Owner confirmation to promote despite the reported acceptance gaps was received on 2026-09-09.

Promotion is limited to df7156b. Keep the served checkout on beta. Outstanding native-platform acceptance and artifact evidence remain tracked; no full live acceptance pass is claimed.