sync: v0.6.1 full sync from cat-cafe (b07d6705b)

[zts212653]

Sync: cat-cafe → clowder-ai

Bug Fixes (P0/P1)

• fix(resolver): deterministic runtime account binding (502 hardening) — Replaced implicit discovery chain with deterministic binding + controlled installer-only fallback. Fixes community-reported 502 regression when multiple accounts configured.
• fix: Redis DEFAULT_TTL → 0 + thread self-healing (LL-048) — User data (threads/messages/tasks/memory) now defaults to persistent (TTL=0). Self-healing rebuilds missing ZSet indexes on startup.
• fix: legacy account migration skips conflicts instead of crashing startup — Global wins on conflict, no more startup crash.
• fix(anthropic): keep seed cats on builtin claude — Prevents seed cat data loss during account resolution.
• fix: session chain badge shows catId instead of ambiguous breed name
• fix: use ANTHROPIC_MODEL env var for third-party model override
• fix(F088): persist contentBlocks in messageStore for queue replay
• fix(a2a): inline mention follow-ups — UX hint, integration test, brand guard

Features

• feat(F152): Expedition Memory — Phase B + Phase C — Bootstrap orchestrator + global lesson distillation pipeline
• feat(F156): WebSocket Security Hardening — D-1 through D-6 — Session auth, anti-clickjacking, XSS baseline, preview-gateway Origin guard, DNS rebinding defense
• feat(F158): Kimi CLI first-class cat — Community contribution (clowder-ai#361) absorbed
• feat: add lastResponseHealthy to ParticipantActivityInput (clowder-ai#435)
• feat(a2a): intake inline action @mention detection (clowder-ai#418)

Other Changes

• Community intakes absorbed: fix(#320): SchedulePanel kind-match filter + taskStore type alignment #383, docs: add persistence and fail-closed cleanup guardrails #405, TD: add cat_cafe_get_thread_cats MCP tool + de-hardcode catId (#408) #412, feat(scheduler): once trigger + lifecycle notifications (#415) #416, feat(a2a): clarify semantic vs actionable @mentions (#417) #418, fix(#340): skip stale project catalog accounts instead of crashing on conflict #423
• Test baseline fixes (schema version, conflict test, runtime worktree lock drift)
• Sanitizer port remap improvements for security-headers tests

Sync Metadata

• Source commit range: 9e548555..b07d6705b
• Source snapshot tag: clowder-v0.6.1-source
• Release tag (pending): v0.6.1
• Included files: 2329 | Excluded: 13 | Transforms: 33
• Security scan: clean

🐾 布偶猫/宪宪
🤖 Generated with Claude Code