docs: document Codex, OpenCode, Agent Joe & visual updates

[alari76]

Summary

The code for the Codex provider, OpenCode resilience, the Agent Joe resilience suite, and the UI/visual updates all merged to main, but the docs never caught up. This PR brings the CHANGELOG and README in sync with the unreleased work (#474–#510).

• CHANGELOG — rewrites [Unreleased] to cover the Codex provider (feat: add OpenAI Codex CLI as a third coding-agent provider #499), Claude Fable 5 (feat: add Claude Fable 5 model support #492), dynamic model discovery (feat: dynamic Claude model discovery #479/fix: include Opus 4.8 and probe candidate model IDs #480), the full Agent Joe resilience suite (feat: realtime blocked-child notifications for Agent Joe (audit P0 1/5) #498/feat: persistent notification outbox with replay for the orchestrator (Joe 2/5) #501/feat: pausable child timeouts, broader allowlist, worktree status (Joe 3/5) #503/feat: ground-truth child completion verification (Joe 4/5) #504/feat: template fixes, child transcript endpoint, org-aware repo discovery (Joe 5/5) #505), OpenCode native integration + runtime + resilience (feat: use OpenCode's native agents, permissions, commands, and system context #494/OpenCode runtime improvements: abort, compact, usage, recovery, subagents #496/feat: OpenCode resilience — hydration, restart recovery, queueing, diff fix, version check #500), the compact new-session dropdown (feat: compact new-session provider dropdown in sidebar #509), UI style audit work (fix: UI theme improvements from style audit (prose, contrast, palette) #508), dark-mode/contrast fixes (fix: dark-mode form controls and gold-button contrast #510), plan-mode lifecycle (fix: plan-mode permission lifecycle, read-only auto-approval, skills refresh #502), security fixes (chore: security quick-wins + docs refresh (L1/M3/M4 + CHANGELOG + env vars + WORKFLOWS) #474/fix(security): server-side magic-byte validation for uploads (M2) #475/fix: harden workflow query builder against SQL injection #490), and docs updates (docs: fix accuracy drift surfaced by docs audit #489/docs: UI style & color scheme audit (light + dark) #507).
• README — adds OpenAI Codex to the intro, prerequisites (codex login), and the multi-provider feature bullet; adds a dynamic-model-discovery bullet; notes Agent Joe's new resilience features.

Docs-only change — no code touched.

Test plan

• Render CHANGELOG/README and confirm formatting
• Verify PR references match merged work

[alari76]

CI Fix: Dependency Audit Vulnerabilities

Root cause: The Audit dependencies step failed because npm audit --audit-level=high found 2 high-severity esbuild vulnerabilities in the server directory:

• GHSA-gv7w-rqvm-qjhr — Missing binary integrity verification in Deno module (esbuild 0.17.0–0.28.0)
• GHSA-g7r4-m6w7-qqqr — Arbitrary file read on Windows dev server (esbuild 0.17.0–0.28.0)

These came in via tsx → esbuild. The root project also had 3 moderate advisories (postcss, brace-expansion, qs) that didn't block CI but were fixed as well.

Fix: Ran npm audit fix in both root and server directories, updating lockfiles to pull patched versions. No package.json changes were needed — the existing semver ranges already allowed the fixed versions. Commit: c4a44c3.

[alari76]

CI Fix: Audit Dependency Failures (Run #1259)

Root cause: The previous fix (c4a44c3) ran npm audit fix but only updated qs in both lockfiles. The actual vulnerable packages were left unchanged:

Package	Location	Old Version	New Version	Issue
esbuild	server (via tsx)	0.27.3	0.28.1	GHSA-gv7w-rqvm-qjhr, GHSA-g7r4-m6w7-qqqr (high)
tsx	server	4.21.0	4.22.4	Depended on vulnerable esbuild
postcss	root	8.5.8	8.5.15	GHSA-qx2v-qp2m-jg93 (moderate)
brace-expansion	root	5.0.5	5.0.6	GHSA-jxxr-4gwj-5jf2 (moderate)

Fix: Updated tsx to ^4.22.4 in server/package.json (which pulls esbuild@0.28.1, outside the vulnerable range 0.17.0–0.28.0), and updated transitive deps postcss and brace-expansion in the root lockfile.

Commit: 0ea1797