Release v0.2.5

[twidtwid]

Summary

Prepare the v0.2.5 release from current main (42f8ffe), following the v0.2.4 version-bump pattern. No feature work in this PR.

• Bump 0.2.4 → 0.2.5 in package.json and both top-level package-lock.json version fields
• Bump plugin manifest.json "Version" to "0.2.5.0" (SDKVersion 3, Node.js 24, MinimumVersion 7.1 unchanged)
• Fold the Unreleased notes from Exclude Guardian reviewer sub-sessions from Agent Status #51 (Guardian/subagent session filter) and Harden SQLite fail-closed reads, model families, and audit overrides #52 (SQLite fail-safe, model families, audit overrides) plus Dependabot bumps including @elgato/streamdeck 3.0.1 into ## 0.2.5 — 2026-10-08

This PR does not include Claude provider / draft PR #33 work. Do not merge from that beta line. Do not tag or create a GitHub Release here; tag after merge so .github/workflows/release.yml can pack and publish.

Validation

• Linux-allowed release:verify subset: audit:full, audit:production, and docs:check (macOS-only native/qa:design steps skipped on Linux)
• test:fast, build:bundle, streamdeck validate, generated:check
• Full npm run check on macOS CI
• Relevant connected-device checks, or an explanation of why they do not apply — version bump and changelog only; no device interaction
• No private data, credentials, proprietary Codex assets, or copied third-party source

User impact

• Agent Status and the native helper no longer show or try to resume Codex Guardian reviewer / subagent sub-sessions (reported by Paweł Lipkowski; fixes "cannot resume a live Guardian reviewer"). A user chat titled Guardian still shows.
• Unreadable Codex SQLite state fails closed; Health and doctor report the store.
• Model dial families come from the Codex models cache.
• Stream Deck SDK 3.0.1 and security overrides (brace-expansion, fast-uri) ship with this release.
• Install from the GitHub Release created when v0.2.5 is tagged after merge.