docs: add release announcement for v2026.05.19

Refs: release v2026.05.19

Author: Alex

.docs/releases/v2026.05.19.md

@@ -0,0 +1,55 @@
+# Release v2026.05.19
+
+**Date:** 2026-05-19
+**Author:** Alex
+
+## Highlights
+
+### Project-Level Config Discovery for terraphim-agent
+
+This release introduces project-level configuration support for `terraphim-agent`, enabling developers to define project-specific roles, global shortcuts, and configuration overrides in a `.terraphim/config.json` file within their project directories.
+
+**Key Features:**
+- **Automatic Discovery**: Searches parent directories for `.terraphim/` directory starting from current working directory
+- **Role Merging**: Project-specific roles override global roles by `RoleName` (full replacement, not deep merge)
+- **Global Shortcut**: Optional `global_shortcut` field allows project configs to omit it
+- **Non-Invasive**: Global config remains unchanged; project config is optional
+
+**Usage:**
+```json
+{
+  "global_shortcut": "Cmd+K",
+  "roles": {
+    "MyProjectRole": {
+      "haystacks": ["/path/to/project/docs"],
+      ...
+    }
+  }
+}
+```
+
+### Security Fix
+
+- **fix(security): char-safe truncation in sanitize_system_prompt** (Fixes #1721)
+
+### Build Improvements
+
+- **fix(build-runner): tee output to file and fix BUILD.md parsing**
+
+## Full Changelog
+
+| Commit | Description |
+|--------|-------------|
+| `59cd233b7` | feat(config): implement project-level config discovery for .terraphim/ |
+| `26f5b8728` | feat(config): implement project-level config discovery for .terraphim/ |
+| `82c746757` | fix(config): remove needless borrows in project.rs clippy warnings |
+| `511813479` | fix(security): char-safe truncation in sanitize_system_prompt Fixes #1721 |
+| `0b1ebf9d2` | fix(build-runner): tee output to file and fix BUILD.md parsing |
+
+## Upgrade Notes
+
+No breaking changes. Project-level config is entirely optional and backward-compatible with existing global configurations.
+
+## Related Issues
+
+- #1721 - Security: UTF-8 boundary panic in sanitize_system_prompt