• Merge pull request #1787 from kaitranntt/kai/fix/docker-release-runners
• fix(ci): migrate Docker release and smoke test workflows to ubuntu-latest
• Merge pull request #1781 from kaitranntt/kai/fix/security-cloud-findings
• Merge remote-tracking branch 'origin/dev' into kai/fix/security-cloud-findings
• Merge pull request #1786 from kaitranntt/kai/fix-ci-runners-ubuntu-latest
• fix(ci): migrate Linux workflows from self-hosted to GitHub-hosted ubuntu-latest
• chore: merge dev into PR 1781 and sync baselines
• Merge pull request #1785 from heydryft/feat/runcrate-preset
• feat(api): add Runcrate provider preset
• chore: format and update baseline
• docs(reports): refresh hardening-inventory metrics
• fix: allow keyless settings delegation and isolate plugin sweep file (fixes #1780, #1756)
• fix(security): resolve findings identified in Codex Security Cloud
• Merge pull request #1779 from KosmoCHE/fix/codex-keep-system-messages
• Merge pull request #1777 from KennethWKZ/fix/quota-notices-in-tui