chore: release v0.10.44 - #597

Cuts [Unreleased] to 0.10.44.

Contents

20 commits since v0.10.43 (2026-08-07).

Security

• Credential guard's filename-search bypass closed (fix: close the credential guard's filename-search bypass #582)
• Shell patterns that expand onto the protected directory are denied (fix: deny shell patterns that expand onto the protected directory #568)
• The Bash guard no longer denies mureo's own identifiers

Meta Ads correctness (found while recording the Meta App Review screencast)

• Lead-form create sends the fields Meta actually requires and reads back (fix: send Meta the lead-form fields it actually requires and reads back #596)
• get_page_access_token skips page entries carrying no access token instead of raising KeyError (fix: skip page entries that carry no access token #595)

Google Ads correctness

• Enum fields resolve to their name, not their raw number (fix: resolve Google Ads enums to their name, not their number #592) — change_import classified changes by exact string match, so this was silently wrong
• Campaign flight dates read from the fields v23 actually has (fix: read campaign flight dates from the fields v23 actually has #583)

Features

• Delivery-collapse detection and diagnosis across all platforms (feat: detect and diagnose delivery collapse across all platforms #572)
• Externally-made changes are imported into action_log (feat: import externally-made changes into action_log (#545) #575)
• Delivery-surface exclusions are a guarded, recorded, reversible operation (Make delivery-surface exclusions an operation mureo can guard, record and reverse #571)
• A bulk change is one revertible unit in action_log and rollback (Treat a bulk operation as one revertible unit in action_log and rollback #569)

This PR

• CHANGELOG.md — [Unreleased] cut to [0.10.44] - 2026-08-12. The section had two ### Fixed headings from overlapping merges; they are merged into one, which is why the diff is larger than a date change.
• pyproject.toml — 0.10.43 -> 0.10.44
• 53 SKILL.md frontmatter version fields synced, matching the convention of previous releases.

No functional change.

After merge

Publishing a GitHub Release for v0.10.44 triggers release.yml, which uploads to PyPI via trusted publishing.