[jamiesun]

Summary

Prepare v0.20.0 with execution-boundary fixes:

• Gate sudo credentials on a session-owned prompt and application input on child readiness. Cover scripts, apply, inspect, SQL, text and leading-sudo commands. Human login delegates sudo authentication to its TTY instead of prefill.
• Keep RouterOS raw text intact, surface recognized device errors, share transport/deadline/audit evidence and guarded file operations, and keep previews offline/conservative.
• Preserve host-test budgets and trust configuration; prefer previously trusted host-key algorithms without relaxing final verification.
• Restore bounded SFTP pipelines and add plan-bound apply --sudo --stage-dir plus MCP parity.
• Improve credential-shaped audit redaction, update public docs/embedded skill and invalidate old plans through execution semantics v2.
• Advance the reviewed build baseline to Go 1.26.10 after govulncheck identified reachable standard-library fixes beyond 1.26.8.

Compatibility

• Re-preview plans after upgrading.
• login --sudo authenticates at the human TTY.
• Noninteractive sudo readiness uses a shell wrapper; command-only sudoers restrictions are not bypassed.
• ROS raw does not append without-paging; supply it explicitly when required.
• ROS offline --expect-plan remains unsupported.

Verification

Locally passed on macOS:

• Go 1.26.10 go test -race -count=1 ./...
• go vet ./..., golangci-lint run ./...
• Current govulncheck: zero reachable vulnerabilities
• Repeated sudo/cancellation race regressions (20 runs)
• Linux/Windows cross-build smoke (native CI is still the platform gate)
• Pre-commit full tests/build/lint

CI adds disposable native Linux sudo policies for PASSWORD, NOPASSWD, cached authentication, root and incorrect credentials. Native SQL/keyring and platform CI must be green before merge/release. No production hosts or credentials are changed by this PR.

Bugfix reflection

• Bug class: input-consumer confusion, duplicated execution/file paths, lost configuration, protocol-vs-domain success confusion.
• Missing invariant: credentials never become application input; result and audit represent the same operation; declared deadlines and guarded publication survive adapters.
• Why old tests missed it: sudo fixtures always consumed a password line, and legacy ROS tests checked happy-path envelopes without auditing wire bytes or filesystem failure boundaries.
• Regression tests: compiled CLI shell/auth branches, native sudo CI, raw/audit/domain-error/file safety, offline preview, host deadlines/algorithms, SFTP pipelining and stage-dir/MCP.
• Docs: AGENT, README/README_CN, execution safety, capability matrix, embedded skill, CLI help and release metadata updated.