- .env: remove real API key, fix duplicate SUNOS_MODEL key
- Policy DSL: wire evaluateRules() into PermissionEngine.evaluate()
- CLI: add memory (list/clear) and config (show) commands
- SIGHUP: implement config reload with log level hot-reload
- Sandbox: implement allowNetwork check via unshare --net + proxy fallback
- Scheduler: wire ResourceLockManager into ToolScheduler.schedule()
- LLM: add createProviderWithTaskRouting(), bridge routeByTask()
- ESLint: add prefer-const, eqeqeq, no-var, no-throw-literal
- CI: add GitHub Actions workflow (test on Node 20/22, lint, typecheck)
- AutonomousMode: reuse PermissionEngine/LLM/MemoryV2 from bootstrap
- AutonomousLoop.shutdown(): implement with AbortController
- getOomEvents(): fix sync version with execaSync
- MemoryStoreV2: add recordAutonomousAction() convenience method
- scripts: create demo-autonomous.sh
- README: fix stale ora reference
- lifecycle: add onConfigReload() registration hook

Co-Authored-By: Claude <noreply@anthropic.com>