7.18.0 (2026-08-12) Features auth: staged managed_by write guard with dry-run reconcile (#319) (#359) (56afd90), closes #318