Merge remote-tracking branch 'origin/main' into capy/fixwave-C1-windows-setup-degrade

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

# Conflicts:
#	CHANGELOG.md
#	VERSION
#	agents-digest/gstack-AGENTS.md
#	package.json

.github/workflows/model-policy-freshness.yml

@@ -0,0 +1,49 @@
+name: Model-policy freshness
+
+on:
+  schedule:
+    - cron: '0 11 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: model-policy-freshness
+  cancel-in-progress: false
+
+jobs:
+  advisory:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 8
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: 1.4.2
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Check and publish main advisory
+        if: github.ref == 'refs/heads/main'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MODEL_FRESHNESS_REPORT: ${{ runner.temp }}/model-policy-freshness.json
+        run: bun scripts/model-policy-freshness.ts --publish
+      - name: Check non-main without publication
+        if: github.ref != 'refs/heads/main'
+        env:
+          MODEL_FRESHNESS_REPORT: ${{ runner.temp }}/model-policy-freshness.json
+        run: bun scripts/model-policy-freshness.ts
+      - name: Preserve evidence report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: model-policy-freshness-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/model-policy-freshness.json
+          if-no-files-found: error
+          retention-days: 90