Package zoryn: Information

- added task manage keys o/O to insert a subtask after/before the current row
- added task batch --batch-pkgs to build only the named packages from a batch config
- added devenv --mount-bind for extra bind mounts on top of [devenv].mounts
- added build watchdogs inactivity_timeout and max_log_mb for parallel builds
- added stalled status to rebuild-stats.json with non-zero exit for incomplete runs
- added submit --no-deps to skip automatic --deps on tasks in fresher repos
- changed [devenv].mounts and --mount-bind to also apply to the bwrap backend
- changed task genbatch to emit gear specsubst groups and valid TOML
- changed Mozilla CVE lookup to scrape the mozilla.org security-advisories site
- fixed oracle-csaf to drop CVEs whose fix is newer than the update target
- fixed Oracle CSAF fetch to fall back to older quarters when the advisory is unpublished
- fixed task manage deps screen (removal, stale lists, refresh, cache bypass)
- fixed shell completion descriptions leaking ANSI escape codes
- fixed devenv image rebuild on bind-mount-only changes and podman probes without podman
- fixed task batch --test to write per-variant build logs again
- fixed process group cleanup for interrupted rebuild workers
- fixed hsh --printenv directory noise in builder status/clean/shell

- fixed builder shell to refuse when the builder's hasher chroot is uninitialized
- fixed devenv for domain users whose UID/GID is out of range
- fixed build to create hsh's effective workdir when the build command passes no hasher_dir
- changed the installed Agent Skill reference to embed self-contained devenv build guidance

- added zoryn devenv profile list command (prints config profiles; --verbose shows resolved config)
- added zoryn up --no-gpg-sign for zoryn's own automated commits
- added GLM-claude-code devenv feature (Claude Code CLI with a separate profile)
- added .gear/version-up template default values syntax {patch:0}
- added zoryn devenv terminal window/tab title during build and use
- fixed builder mountpoint auto-fix to classify device nodes vs mountpoints (allowed_devices vs allowed_mountpoints) (closes: #59656)
- fixed devenv argv reordering to recognise the profile sub-command
- fixed zoryn up --switch-to-upstream-git to force-stage .gear in gitignored repos
- fixed zoryn up --switch-to-upstream-git to write a templated self-excluding tar: rule
- fixed gen-pypi2spec, gen-opam2spec and gen-watch to force-stage generated .gear files
- fixed ppx_shell_check to reject mixed escaped/raw shell concatenation
- fixed devenv TOML parse errors to warn with line and column instead of silent empty config
- fixed zoryn up automatic tag discovery to derive the spec version through the version-up template
- fixed sandbox bwrap/hybrid runners to pass script and args as positional parameters