• fix(channels): avoid secrets in --set-token argv (#1389)
• fix(web): avoid runtime proxy probes on public masked settings route (#1388)
• fix: reject unsupported image analysis backends (#1387)
• fix(cliproxy): prevent management key leak on runtime proxy overrides (#1386)