chore(release): 0.99.0

[soustruh]

Release 0.99.0

Fifteen changes since 0.98.0:

• feat(project): accept a Storage token without the command line #728: project add and project edit take a Storage token from --token-stdin, --token-file or --token-env, so the token does not go into the shell history.
• serve: enforce the permission firewall on every REST route (#655) #682 (serve: PermissionEngine firewall is not enforced on REST routes #655): kbagent serve applies the permission policy to every REST route. GET /permissions/show reports the policy that the server uses.
• fix(sync): keep UI edits of adopted configs and encrypt secrets before the first push write #839 (Pilot: formal verification (TLA+ / Lean) of the sync engine and other data-loss-critical state machines #792): sync push no longer overwrites a UI edit of an adopted config, and it encrypts all secrets before its first write.
• fix(storage): budget create-table/swap-tables job waits, add --timeout (#713) #720 (storage: no metadata-only path to update BigQuery clustering on an existing table (Storage API's PUT .../definition lacks a clustering field) #713): storage create-table and storage swap-tables wait up to 300 seconds and take --timeout. A timeout is no longer retryable.
• fix(workspace): branch-aware --ui job, roll back sandbox config on failed create (#755) #756 (workspace create --ui never produces a workspace - leaves an orphaned keboola.sandboxes config behind #755): workspace create --ui runs its job in the active dev branch and cleans up the sandbox config after a failed create.
• managed-repo data apps never get a workspace on first deploy #765 (CLI-15): data-app deploy adds the Git block of a managed-repo app, so the app gets its workspace on the first deploy. New --git-branch option.
• fix(config): open the oauth-url link in the browser and print it unwrapped (SUPPORT-17391) #726 (SUPPORT-17391): config oauth-url opens the link in the browser and prints it without line breaks.
• fix(auth): report the browser wait of auth login and the way out #841 (kbagent auth login: no redirect back to CLI when user isn't already logged in to the platform #780): auth login says what it waits for in the browser and how to switch to the device-code login.
• fix(update): show why a startup update failed, and how to move an install from the old package name #840 (Auto-update permanently broken for installs made under the old keboola-agent-cli package name (executable conflict, cause swallowed) #771): a failed update at startup prints the cause and the recovery command.
• fix: security hardening from the #271 audit (sec-09, sec-10, sec-12, sec-16, sec-17) #842 (Security audit follow-ups: 10 deferred findings (sec-03, sec-09, sec-10, sec-12, sec-13, sec-14, sec-16, sec-17, sec-18) #271): security hardening: pinned Mermaid with an integrity check in lineage HTML, an atomic version cache with mode 0600, a warning for a renamed branch directory in sync, and clearer docs on the permission policy.
• fix(plugin): trim keboola-expert.md under the prompt budget #843, fix(frontend): override postcss-selector-parser to 7.1.6, keep Tailwind 3 #844, chore(deps): bump fast-copy from 4.0.3 to 4.1.2 in /web/backend #832, chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /web/backend #831, chore(deps): bump source-map-js from 1.2.1 to 1.2.2 in /web/frontend #829: housekeeping. A shorter keboola-expert prompt, and dependency updates in the web UI and its backend.

This PR bumps the version to 0.99.0 and adds the changelog entry. It resolves the vNEXT doc tags to 0.99.0 and runs version-sync (plugin.json / marketplace.json / uv.lock). It also resolves the (since vNEXT) tag in README.md by hand, because make vnext-resolve does not scan README.md. No whatsnew.ts entry: the release ships no UI change.

Plugin files changed: plugin.json, keboola-expert.md, gotchas.md, commands-reference.md, auth-workflow.md, data-app-workflow.md, oauth-workflow.md, scaffold-workflow.md, storage-types-workflow.md, sync-workflow.md, workspace-workflow.md.

make check, make vnext-check and make release-scope-check pass. make test-e2e did not run (no E2E credentials).

After merge: tag the merge commit v0.99.0 to trigger the release pipeline (PyPI + native binaries + GitHub Release).

[keboola-pr-reviewer-bot]

Verdict: needs_human (risk 2/5) · profile _default

Routine 0.99.0 release PR; benign but touches agent-instruction files, which policy forbids auto-approving.

Concerns:

• plugins/kbagent/agents/keboola-expert.md: Agent-instruction file edited; policy forbids auto-approving (benign vNEXT→0.99.0 swaps here)