chore(release): v0.0.31 - #44

First release cut from the fork.

Bundles this session's work:

• Publish releases from this fork (point auto-update at JeanBaptisteRenard/switchboard) #39 publish target → this repo + auto-update channel
• fix(release): disable mac notarization so unsigned builds don't fail CI #40 mac builds green (notarize disabled until Apple secrets set)
• 🔒 security: harden scheduler/auth/mcp against shell injection (port upstream #32) #41 scheduler/auth/mcp shell-injection hardening (port upstream feat(stats): collect token/tool/message metrics for the stats screen #32)
• 🔒 security: validate IPC file paths, sanitize viewer HTML, add CSP (port upstream #27) #43 IPC path validation + viewer XSS sanitization + CSP (port upstream feat(trigger-watcher): add chain field for sequential injection #27)
• feat(terminal): keep terminal mounted with exit banner on session death (port upstream #58) #42 terminal exit banner (port upstream perf(grid): virtualize WebGL contexts on off-screen grid cards #58)

Tagging v0.0.31 after merge triggers the build pipeline → draft release with mac/win/linux artifacts. Verify the built AppImage (real CSP runtime check) before clicking Publish.