release: 0.26.0

[TheAmericanMaker]

Summary

Version bump to 0.26.0 (package.json, package-lock.json, server.json ×2, scaffold-version.yaml) and the CHANGELOG block: the self-audit's batch — #375 (#358), #376/#379 (#355), #377 (#356), #378 (#357), #380 (#359), #381 (#360), #382 (#361), #383 (#362), #384 (#365), #385 (#366), #386 (#367), #387 (#368), #388 (#369), #389 (#370), #390 (#364), #391 (#371), #392 (#372) — plus #353, #354, #373, #374 from before. Minor bump: the lock's on-disk shape changed (tickets beside the lock path; a pre-0.26.0 process's plain lock file is still honoured while fresh).

Surface verification (on the packed tarball, codecartographer-pi-0.26.0.tgz, built from a clean dist/)

• MCP: scripts/smoke-mcp.mjs --tarball 9/9; full round trip (init → next → artifact → validate → complete → next → status) against the tarball's bin.mjs, routed carry-forward item present in the contracts prompt.
• Pi: one real architecture phase on the packed extension with ollama-cloud/deepseek-v4.1-flash: sub-agent 19 turns / 63 tool uses, **Overall:** PASS, current_phase: complete, closeout + THREAD_LOG + dashboard, Auto pipeline complete: 1/1 phases.; no lock tickets left in workflow/ afterwards.
• Codex 0.154.0: codex exec round trip (init lite → next) against the tarball's bin.mjs, both calls (completed), 15k tokens.
• Windows: the new non-blocking job reports 925/935 on main — the two product failures are atomicWriteFile: rename over an existing file fails with EPERM on Windows under concurrent writers #393 and Pi write guard refuses a legitimate .codecarto/ write on Windows #394, the eight test expectations Tests: eight expectations assume POSIX paths and fail on Windows #395.
• Broad-Side live: not run (no key); this release's Broad-Side changes are covered by unit tests with the request shapes pinned (verify redaction, post-pass parsing, run ids, slice mode, retry errors).

🤖 Generated with Claude Code