chore: release v0.25.0

[danielmeppiel]

ship(release): prepare v0.25.0

TL;DR

Cut release 0.25.0 from the 11 pull requests merged after v0.24.1.
This PR moves the user-facing changes into a dated changelog section,
updates the project and lockfile versions, and leaves tagging as the
post-merge human gate. The complete CI lint mirror is green locally.

Important

This PR stops before tagging. After merge, tag v0.25.0 to trigger
the release workflow.

Problem (WHY)

• pyproject.toml and the editable apm-cli package in uv.lock
  still reported 0.24.1, so the next build needed one authoritative
  version transition.
• The cycle adds supported policy and compile-target integration
  surfaces. The release rubric maps
  "ANY PR added a NEW supported target / adapter / integration host"
  to a MINOR bump.
• PR refactor(core): consolidate red-team lifecycle fixes behind canonical owners #2155 closed 24 issues across distinct user-visible surfaces.
  Compressing them into one broad entry removed the connection between
  community reports and shipped outcomes, so this release preserves grouped
  entries for each outcome family.

Why these matter: Agent Skills defines the validation loop as
"The pattern is: do the work, run a validator (a script, a reference checklist, or a self-check), fix any issues, and repeat until validation passes."
The release range, version decision, lockfile refresh, and lint result
therefore come from repository scripts and Git evidence rather than recall.

Approach (WHAT)

1. Enumerate v0.24.1..HEAD from Git history and GitHub metadata.
2. Select 0.25.0 because Row 6 of the release rubric fires; reject
   0.24.2 because a patch would understate new integration surfaces.
3. Rewrite [Unreleased] as [0.25.0] - 2026-07-12, keep concise entries
   for normal PRs, and preserve 11 grouped user-outcome entries for refactor(core): consolidate red-team lifecycle fixes behind canonical owners #2155 with
   all 24 closed issues linked.
4. Run the repository bump script so pyproject.toml and uv.lock
   move together, then pass every CI lint guard before opening the PR.

Implementation (HOW)

File	Change	Deliberate boundary
CHANGELOG.md	Adds the dated 0.25.0 section and restores 11 grouped #2155 outcomes covering all 24 closed issues.	Keeps an empty [Unreleased] placeholder and credits external contributors.
pyproject.toml	Changes the package version from 0.24.1 to 0.25.0.	No dependency or build-backend edits.
uv.lock	Updates the editable apm-cli version and refreshes the existing exceptiongroup marker metadata through uv lock.	The resolved package set is unchanged.

Diagrams

Legend: the dashed nodes are the release-preparation steps in this PR;
the final tag remains outside the PR as a human-controlled action.

flowchart LR
    subgraph Inputs[Release inputs]
        P["11 merged PR records"]
        C["CHANGELOG.md Unreleased"]
        V["pyproject.toml version 0.24.1"]
    end
    subgraph Prep[Release preparation]
        S["Sanitize user-facing entries"]
        B["Bump version to 0.25.0"]
        L["Regenerate uv.lock"]
        G["Run CI lint mirror"]
    end
    subgraph Gate[Human release gate]
        R["Release PR"]
        T["Tag v0.25.0 after merge"]
    end
    P --> S
    C --> S
    V --> B
    B --> L
    S --> G
    L --> G
    G --> R
    R --> T
    classDef new stroke-dasharray: 5 5;
    class S,B,L,G,R new;

Loading

Trade-offs

• MINOR instead of PATCH. Chose 0.25.0; rejected 0.24.2
  because supported policy and compile-target surfaces make Row 6 the
  highest applicable release signal.
• Grouped outcomes instead of one entry per merged PR. Chose 11 refactor(core): consolidate red-team lifecycle fixes behind canonical owners #2155
  entries because one unusually broad PR closed 24 distinct issues; rejected
  one mega-entry and 24 repetitive entries because neither is traceable and
  scannable.
• Human tag instead of automatic publication. Chose a post-merge
  v0.25.0 tag; rejected tagging from this branch because the release
  workflow intentionally starts only after maintainer approval.
• Scenario Evidence skip. This is a pure release metadata and asset
  bump with no runtime behavior change; the rubric's pure asset-bump
  skip applies.

Benefits

1. 0.25.0 appears consistently in both package version authorities.
2. Every issue closed by refactor(core): consolidate red-team lifecycle fixes behind canonical owners #2155 appears exactly once in a concrete,
   user-visible changelog outcome.
3. The next release cycle starts with an empty [Unreleased] section.
4. Publication remains blocked until a maintainer merges and tags
   v0.25.0.

Why MINOR (0.25.0), not PATCH (0.24.2)

MINOR because this cycle expands supported policy and compile target
integrations, adds contributor-dashboard workflows, and ships user-facing
reliability and performance fixes. No **BREAKING:** marker appears in
the release range, so a major escalation is not warranted on the pre-1.0
line.

Validation

CI lint mirror

./.agents/skills/cut-release/scripts/verify-lint-mirror.sh:

=== verify-lint-mirror summary ===
  ruff check                     PASS
  ruff format --check            PASS
  pylint R0801 duplication       PASS
  auth-signals boundary          PASS
[+] all lint-mirror checks PASSED

The YAML I/O, 2100-line source-file, and raw str(relative_to())
guards also completed with no findings.

Scenario Evidence

Skipped under the pure asset-bump clause: this PR changes release notes,
package metadata, and lock metadata without changing runtime behavior.

How to test

• Confirm pyproject.toml reports version = "0.25.0".
• Confirm the editable apm-cli package in uv.lock reports
  version = "0.25.0".
• Review CHANGELOG.md and confirm [Unreleased] is empty above
  [0.25.0] - 2026-07-12.
• Run ./.agents/skills/cut-release/scripts/verify-lint-mirror.sh
  and observe four PASS rows plus the final success line.

Post-merge

Tag v0.25.0 to trigger the release workflow:

git tag v0.25.0
git push origin v0.25.0

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[danielmeppiel]

Docs sync advisory

Verdict: no_change * Pages affected: 0 * LLM calls: 1/15 * Took: 1s

Summary

No documentation changes are needed for this release-preparation PR.

All three changed files -- CHANGELOG.md, pyproject.toml, and uv.lock --
match the documentation index's no-impact paths, and none match a user-surface
path. The PR reorganizes release notes and synchronizes package metadata; it
does not add, remove, or rename CLI commands, flags, schemas, or user-observable
APIs in docs/src/content/docs/.

---

How this advisory was produced

• Classifier verdict: no_change (confidence: high, source: L0)
• Panel composition: classifier only
• Tool-verified claims: 0 (0 verified, 0 refuted, 0 inconclusive)
• CDO redraft rounds: 0/3

This is an advisory comment from the docs-sync skill. It does not gate merge.
The maintainer ships.

Re-run by removing and re-applying the docs-sync label.

[Copilot]

Pull request overview

Prepares the v0.25.0 release by moving the user-facing notes into a dated changelog section and aligning the package version across the Python project metadata and uv lockfile.

Changes:

• Added a 0.25.0 dated section to CHANGELOG.md and left [Unreleased] empty for the next cycle.
• Bumped apm-cli version to 0.25.0 in pyproject.toml.
• Updated uv.lock to reflect apm-cli==0.25.0 (and refreshed some lock metadata).

Show a summary per file

File	Description
CHANGELOG.md	Adds the 0.25.0 release section and reorganizes entries into Added/Changed/Fixed/Performance.
pyproject.toml	Updates the package version from 0.24.1 to 0.25.0.
uv.lock	Updates the editable apm-cli version to 0.25.0 and refreshes dependency metadata for at least exceptiongroup.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 3
• Review effort level: Low