Niro v0.1.74

Summary

start_pentest now requires project_root, and pentests of targets with no
source are reported in telemetry.

Changes

• start_pentest requires project_root in every mode: an absolute path to
  the source under test, or "none" for an external target with no source
  available.
• Telemetry now reports pentests of targets that have no source. Those events
  carry no repository fields.
• Telemetry adds two true/false values: whether source was under test, and
  whether the target was on the same machine. The target URL is still never
  sent.

Security

None.

Compatibility and upgrade

start_pentest calls that omit project_root are rejected. If you drive Niro
with your own agent, pass the path to the source under test, or "none" when
there is none. No action is needed for the bundled workflows.

Known issues

• checksums.txt does not cover niro.mcpb.
• Release artifacts have no detached signatures, provenance attestation, or SBOM.