• chore(sync): merge main into dev after release
• fix(config): bind dashboard to loopback by default
• fix(security): protect dashboard WebSocket upgrades
• fix(ci): run pull request validation on hosted runners
• fix(codex): require local access for dashboard config routes
• security(browser-mcp): restrict model-callable local file uploads/downloads to safe roots and deny sensitive paths (#1220)
• fix(ui): keep codex toml tokens inline (#1219)
• fix(ui): wrap codex config highlight editor (#1217)
• fix(ui): restore codex config highlighting (#1216)
• fix(ui): render codex config as exact text (#1215)
• fix(cliproxy): explain headless Codex OAuth recovery