chore(main): release 0.9.1

[synthorg-repo-bot]

Highlights

AI-generated summary (model: mistral-large-latest via Mistral). Commit-based changelog below.

What you'll notice

• First-time setup now completes reliably with clearer error messages.
• Large model downloads show progress and warn about disk space.
• Failed upgrades automatically roll back to the last working state.
• Provider API keys are no longer embedded in configuration files.

Under the hood

• Security and reliability improvements across the backend runtime.
• Faster test execution with shared app builds.

🤖 I have created a release beep boop

0.9.1 (2026-06-21)

Features

• meta-loop apply paths -- durable backing + real apply() (#2427) (b2fb4f7), closes #2422
• surfaces follow-up — drop embedded provider api_key + CLI/eval/e2e housekeeping (#2423) (8cbad3e)

Bug Fixes

• harden CLI teardown & pre-init config UX (#2432) (a14c675), closes #2428
• harden onboarding backend (registry logs, provider persistence, retry-after, presets) (#2446) (1b4960d)
• onboarding-infra Caddy volume perms + compose hygiene (#2443) (c5b1872), closes #2441
• surface fine-tune size warning and stream pull progress in CLI (#2444) (457fbba)
• web: onboarding audit — kill provider presets request storm + wizard/provider-form hardening (#2445) (4273551), closes #2438
• wire rollback-executor into boot with auto-rollback on regression (#2442) (1c3c301), closes #2436

Refactoring

• architecture, persistence, and security hardening (audit-2404) (#2415) (ed84a6e)
• backend runtime correctness + observability (#2402) (#2410) (58cb69b)
• backend-runtime remainder — idempotency, lifecycle-locks, controller-to-service, shutdown drains (#2418) (68c5f00)
• conventions, dedup and async PR2 carryover (#2416) (484f612)
• Gate 11 overflow — test comment-rot + suppression consolidation (#2417) (01dec40)
• persistence: squash migration revisions into a single baseline (#2434) (a3f6474)

Tests

• migrate per-test app builds onto the shared app, exempt essential builds (#2435) (cd9966d)

CI/CD

• adopt merge queue to fix required-check deadlock (#2431) (88f1113), closes #2429
• drop unavailable merge_queue rule from branch-protection spec (#2433) (3b78f93)

Maintenance

• adopt deferred Playwright and CodSpeed capabilities (#2425) (4d3995b)
• Lock file maintenance Lock file maintenance (#2430) (0c4bb79)
• pin undici/esbuild overrides in site, cap undici renovate at 7.x (#2426) (e93b8b6)
• surfaces audit — docs, frontend and housekeeping (#2405) (#2412) (4abad2c)
• Update Infrastructure dependencies (#2420) (3df9163)
• Update Python dependencies (#2419) (725e81b)
• Update Python dependencies (#2437) (9d78d8e)
• Update Web dependencies (#2421) (4c1fbe5)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codspeed-hq]

Merging this PR will not alter performance

✅ 108 untouched benchmarks

---

_{Comparing release-please--branches--main--components--synthorg (01f10fe) with main (1b4960d)}

[synthorg-repo-bot]

🤖 Created releases:

• v0.9.1

🌻