Changes

• fix(discovery): stop the ICMP pre-sweep silencing whole subnets
  • PR: #3085
• fix(offline): serve every browser library from the install, not a CDN
  • PR: #3087
• fix(call-sms-config): let two configs share Twilio credentials (#3020)
  • PR: #3086
• fix(helm): stop the worker fleet pinning at maxReplicas on queue depth
  • PR: #3090
• refactor(dashboard): rebuild the AI Insights inbox and detail page
  • PR: #3089
• Overhaul Status Page > Resources into a two-pane explorer
  • PR: #3092
• fix(dashboard): close the defects an adversarial review of the insights UI found
  • PR: #3093
• fix(status-page): put the Resource Groups card on the product's own controls
  • PR: #3091
• fix(dashboard): bind public resource lists to stored widgets
  • PR: #3094
• test: expand unit + E2E coverage (recording-rule DSL, enterprise seat counting, notification rules, App health)
  • PR: #3097
• test: remove duplicate suites that shadow existing coverage
  • PR: #3098
• feat(dashboard): external Data Sources — connect Prometheus, SQL, ClickHouse, Loki, Elasticsearch and REST APIs to dashboards
  • PR: #3100
• fix(security): enforce owner scope for current-user records
  • PR: #3095
• fix(security): block SSRF via status page subscriber webhooks (GHSA-gf3v-98g2-qffx)
  • PR: #3101
• fix(security): scope status page subscriber lookup to its status page
  • PR: #3103
• feat(analytics): measure self-serve revenue funnel
  • PR: #3109
• perf(telemetry): batch trace/log/metric ClickHouse inserts across jobs
  • PR: #3104
• test(telemetry): make the batched-insert tests mutation-proof (follow-up to #3104)
  • PR: #3110
• test(telemetry): make the batched-insert tests mutation-proof
  • PR: #3111
• perf(telemetry): Phase-1 worker-efficiency fixes from the ingest-path audit
  • PR: #3113