Features
#5024 Embed fallback X.509 roots to support sandboxed environments
Fixes
#5018 More signature related filename extension exclusions @scop
#5025 Extract packages into a temp dir and rename atomically
Documentation
#5023 Add a guide to use aqua with Claude Code's sandbox