Baixar Common Agent Runtime 0.51.0 per a Windows

## v0.51.0

### Changed

• **The coder's shell now holds no forge credential**, which is the one version
of "the model cannot publish" that does not depend on out-lexing `/bin/sh`.

The deny-list added in car#1074 is hardening, not a sandbox：it reads the verb
of each shell segment and then hands that segment to `/bin/sh`, so `sh -c`,
`env`, `timeout`, `$(…)`, a `\gh` escape, or a delegated `car do "…push it"`
all move or bypass the verb. No finite set of patterns closes that against an
unrestricted shell.

Credential separation has a different shape. `GH_TOKEN`, `GITHUB_TOKEN` and
their enterprise spellings are removed from the child; `GH_CONFIG_DIR` points
at an empty directory so `gh` cannot fall back to `~/.config/gh/hosts.yml`;
and git's `credential.helper` is overridden to empty for that child. That last
one is easy to miss and would have left the hole open on its own — `git push`
over HTTPS never reads `GH_TOKEN`, it asks the helper, which on a Mac is
perfectly happy to hand over a stored credential.

Every route then fails on **authentication** rather than on being recognised,
and because environment removal is inherited by the whole process tree it
covers the spellings the matcher cannot see. Delivery is unaffected:
`coder::merge` is host code that builds its own argv outside the model's shell
and keeps the real credential. The runtime publishes; the model cannot.

**Deliberate cost:** on a **private** repository the read allowlist
(`gh pr view`, `gh run view`, `gh api` GET) now fails unauthenticated, so a
session cannot watch its own CI there. Public repos are unaffected. Restoring
it means either a scoped read-only token for the coder shell or moving CI
observation into host code — both larger than this change, and neither done.

Contract checks keep their credentials：a check runs a command the contract
declares rather than one the model just wrote, and may legitimately need to
reach a real system (car#1066). The `run_shell` / `run_check_shell` split from
car#1065 is what makes that distinction expressible.

Closes #1084.

### Added

• **The coder now reads what the repository says about how to work in it**
(`CLAUDE.md` / `AGENTS.md`, and `.car/` project knowledge). Previously
everything a session knew about its repo was two lines from `summarize_repo`
— the top-level entries and which build files exist.

The rules that get a diff rejected are almost never expressible as an outcome
contract. "No cargo feature flags, ever" and "a change crossing the FFI
boundary updates five surfaces in the same change" are review-time rules; a
model that has not read them does the *normal* thing and produces a diff that
compiles, passes every check, and is rejected on sight. Contract-green and
mergeable are different properties, and only one of them was reaching the
model.

The block lands after `ENVIRONMENT:` and before the how-to-work rules,
because these are constraints on *how* the work is done rather than facts
about the machine. Its framing is load-bearing rather than decorative：it
states that the contract does **not** verify these rules, and that a check
must never be weakened or edited to satisfy one — the contract decides
whether the work is done, the instructions decide whether it is acceptable.
A repo carrying neither instructions nor a `.car/` project gets a
byte-identical prompt to before, and there is a test pinning that.

`.car/` discovery reuses `car_memgine::project`, which already walks up from
a starting directory the way `.gitignore` resolution does, so a session cut at
a subdirectory still finds the project.

**Delegation is handled by indexing, not inlining.** Instruction files point
elsewhere — this repo's `CLAUDE.md` says the full binding surface "lives in
the `car-bindings-api` skill". Handing the model a pointer it cannot follow is
worse than useless：it learns a rule exists without learning what it says. So
`.claude/skills/*/SKILL.md` frontmatter is indexed by name, one-sentence
description and **path**, with an instruction to `read_file` the relevant one
before editing in its area. Bodies are never inlined — five would swamp the
prompt, and they are ordinary files the model can already open. A skill whose
frontmatter cannot be read is skipped rather than guessed at.

**Two limits remain, stated because they are easy to mistake for coverage.**
Nested `CLAUDE.md` files are not walked (`car-ffi-napi/CLAUDE.md` documents
five bugs with "do not reintroduce them"). And graph-memory recall stays
assistant-only — the coder's `RepairMemory` carries its own failure
signatures, not facts the team stored.

Refs #1071.

• **A coder session whose correct outcome is "do not change the code" can now
say so** (`car code-task`). Previously `CoderState`'s only non-failure
terminal was `Merged`, which requires a diff that turned a contract green, so
a session that investigated correctly and concluded nothing should change
landed on exit 1 — documented as "the work is genuinely not done; back off".
An orchestrator branching on exit codes was told to retry a task that had been
answered on the first attempt, and a runtime that can only score restraint as
a loss applies steady pressure toward shipping something. That pressure is
worst precisely where restraint matters most.

New terminal `CoderState::Reported`, new `Outcome::Reported`
(`status："reported"`, exit **0**, `failure_class: "none"`). Exit 0 rather
than a fourth bucket, because a new non-zero code would make ordinary process
supervisors classify a correct result as a failure, while 1/2/3 all mean the
wrong thing — not "redo it", not "the machinery broke", not "park it". Exit 0
says the one right thing, *do not retry*; `run_end.status` carries the
delivered-versus-triaged distinction for anything that needs it.

The model's `report_no_change` call is a **nomination, not a verdict** — it
cannot set a terminal state. `coder::no_change::evaluate_nomination` judges it
against facts the runtime collected, and most branches are refusals：a session
that ever mutated is ineligible and **reverting does not restore
eligibility** (otherwise try-fail-revert-declare is a laundry for any hard
task); the worktree must be pristine now, with git failing to answer counting
as *not* clean; and the baseline must have completed, since a run the session
clock cut short is not evidence. `shell` is judged by effect — fingerprinted
either side — so investigating with grep, builds and tests is free while a
shell that writes disqualifies exactly as `edit_file` does.

Exactly one path terminates without a human：kind `premise_wrong`, every check
green against the untouched baseline, **and** a trusted contract.
`ContractProvenance::is_trusted` is the single definition of trusted —
operator-supplied, human-confirmed, or runtime-generated — and a
model-derived contract is never trusted at any tier, because a model citing
its own checks as proof it need not work is the escape hatch the gate exists
to close. Everything else routes to a person; headless that is
`finding_needs_review` at exit **3**, never exit 0, since a pending approval
is not a verified result.

`report_no_change` is offered only to a caller that declares
`can_adjudicate_no_change` (default **false**). A caller that cannot judge a
nomination must not invite one — `LoopOutcome` would return neither green nor
failed, and a caller unaware of that third shape reads it as an ordinary red
and silently discards the finding.

Partial：this ships the headless path. The daemon's `coder.resolve_finding`
gate, `NeedsYou::Finding` on the board wire, and the FFI surfaces follow.

Refs #1070.
• **`car coder-ab run --report-issues` files durable-fix proposals as issues
instead of leaving them on disk.** `synthesize_proposals` already folded a
dogfooding round's losses into ranked, evidence-backed proposals naming which
CAR component to change and on what evidence. Those proposals were then
`println!`'d and written to `learnings-<unix>.md` — and that was the end of
them. The module doc names the intended consumer ("a human, or a coding
agent, implements and merges"); nothing carried the proposal to one.

Reports go to **`Parslee-ai/car-releases`** by default (`--report-repo`
overrides), not to the source repo. That is the load-bearing split：filing a
defect report needs no source checkout, so any deployment with telemetry can
report a defect it has no ability to fix, while fixing it needs the `car`
source. The new `IssueApi` seam is therefore a sibling of `merge.rs`'s
`GitHubApi` rather than an extension of it — that trait resolves its
repository from the checkout's `origin`, which is exactly the wrong rule here.

Filing is **idempotent by signature**：every body carries
`<!-- car-fix-signature：<hex> -->`, a hash over the proposal's stable
identity (target component + failure pattern), deliberately excluding the
title and `evidence_tasks` because both change every round and would make each
re-run a fresh duplicate. The lookup is a bounded list-and-match over open
issues rather than `--search`, because GitHub's search index is eventually
consistent and two quick rounds would each find nothing and each file. A
signature whose issue was **closed** and then recurs is reported again on
purpose：recurrence after a fix means the fix did not hold.

A noise gate keeps the tracker readable — `Confidence::Strong` files
unconditionally, `Tentative` only once `evidence_count >= 2`. Reporting is
opt-in, and a tracker failure is recorded against the individual proposal
rather than aborting the round.

Closes #1077.
• **Only CAR talks to CAR over the network (ed25519 peer authentication).** The
A2A surface now binds a LAN-reachable address **by default**, which is only
safe because