chore(main): release codex-pooler 0.5.19

[github-actions]

🤖 I have created a release beep boop

0.5.19 (2026-08-07)

Features

• admin: expose metrics authentication state (7ada8d5)
• admin: show runtime firewall session state (de3bd07)
• ingress: add explicit forwarded client policy (1652d3a)
• ingress: expose firewall denial telemetry (6f3db40)
• mcp: support the 2026-07-28 protocol (cacc0cd)
• security: retain bounded ingress peer provenance (0b482bf)

Bug Fixes

• admin: clarify runtime firewall route scope (0e6962f)
• admin: complete firewall session state coverage (fe7ea2d)
• deps: update dependency @astrojs/starlight to v0.41.7 (#265) (c1bea14)
• dev: resolve impeccable live helper from its handshake file (439acec)
• dev: scope impeccable live constants to the dev-features guard (ef8553f)
• docs: enforce ingress boundary contract (3bbea63)
• gateway: cancel abandoned websocket work across topologies (4cf4b18)
• gateway: close abandoned upstream websocket requests (4988adb)
• gateway: enforce image generation policy in dispatch (51ad37a)
• gateway: stagger websocket owner lease renewals (c9bd890)
• ingress: add canonical runtime path classification (0d29c8d)
• ingress: bound forwarded client resolution (28d9391)
• ingress: enforce configured forwarded client source (0b68691)
• ingress: enforce decoded runtime path boundaries (2487c2a)
• ingress: enforce strict canonical IP rules (f68ae51)
• ingress: fail closed on unavailable settings (16ce194)
• ingress: reuse forwarded client resolution (b3d3311)
• mcp: align unsupported protocol error messages (bb67216)
• monitoring: scope firewall denial dashboard (3b8dbc7)
• openai: adapt explicit prompt cache controls (7ae45e7)
• responses: accept custom tools inside namespaces (245e280)
• responses: clarify namespace tool validation error (77cb8fd)
• security: bind local browser trust to the immediate peer (e9580ba)
• security: enforce ingress firewall for pruned runtime routes (67fbefd)
• security: reject malformed immediate peer addresses (2da890e)
• security: validate preserved peer addresses with OTP (e0f3c02)
• settings: make instance cache self-healing (d16895d)
• settings: remove unsupported database setting env aliases (2ba2287)
• test: isolate database state and expected logs (64c5f42)
• v1: centralize pool compatibility authorization (baed23c)
• websocket: revoke sockets after firewall updates (578b90a)

Performance Improvements

• gateway: compile test settings overrides out of production (10fba6e)

---

This PR was generated with Release Please. See documentation.