chore(deps): bump github.com/OpenLinker-ai/openlinker-go from 0.2.0-rc4 to 0.2.0-rc5

[dependabot]

Bumps github.com/OpenLinker-ai/openlinker-go from 0.2.0-rc4 to 0.2.0-rc5.

Release notes

Sourced from github.com/OpenLinker-ai/openlinker-go's releases.

v0.2.0-rc5

What's Changed

• feat(runtime): bind browser interaction authority by @​kinzhi in OpenLinker-ai/openlinker-go#29

Full Changelog: OpenLinker-ai/openlinker-go@v0.2.0-rc4...v0.2.0-rc5

Changelog

Sourced from github.com/OpenLinker-ai/openlinker-go's changelog.

[v0.2.0-rc5] - Unreleased

Added

• Added trusted Browser execution authority to Runtime assignments, including execution profile, interaction policy generation, and an exact canonical mutation-origin scope with SHA-256 binding.
• Added Browser policy and contract evidence to typed Run responses and the public Core client contract fixture.

Security

• Runtime Workers now fail closed when Browser authority is incomplete, broadened, non-canonical, duplicated, unsorted, or digest-mismatched.
• Browser mutation origins use the same strict HTTPS, IDNA, numeric-port, IPv4, and IPv6 canonicalization rules as Core and the Browser protocol. Ambiguous legacy IPv4 spellings and IPv4-mapped IPv6 are rejected.

[v0.2.0-rc2] - Unreleased

Added

• Added typed RecommendTask and CancelRun user-client methods so JSON-first callers do not need to duplicate Core REST transport logic.
• Added RuntimeWorkerConfig.RequireTokenOnly, ErrRuntimeSecurityPolicyUnsupported, and the native-runner option for hosts that deliberately omit mTLS and must fail closed when discovery requires it.

[v0.2.0-rc1]

This release candidate is the breaking preview for the v0.2.0 Runtime API layering. Pin the exact RC tag during validation; do not depend on main, latest, a committed local replace, or a vendored SDK copy.

Added

• Added the high-level WithAgent, WithFunc, and Native facades over the canonical reliable RuntimeWorker, including event/progress helpers, assignment context, retryable failures, explicit registration, environment configuration, and RunOrRegister.
• Added creator and pending-token Agent registration clients, AgentSpec, registration policies, and a durable .env registration store.
• Added RuntimeWorker, the SDK-owned reliable worker for Runtime discovery, mTLS, WebSocket and HTTP pull recovery, Session lifecycle, assignment confirmation, lease renewal, resume, cancellation, drain, and encrypted durable Event/Result delivery.
• Added a strict Runtime WebSocket client that reuses the configured mTLS transport and Agent Token, performs runtime.hello / runtime.ready, uses a single writer, enforces the 4 MiB envelope limit, correlates business ACKs by reply_to_message_id, supports multi-message resume, and exposes typed assignment, cancellation, drain, and lease-revocation pushes.

... (truncated)

Commits

• e3eb796 Merge pull request #29 from OpenLinker-ai/code/browser-full-interaction
• c9f20f8 feat(runtime): bind browser interaction authority
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #18.