V0.38.5 git board rewrite (#238)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [0.38.5.0] — 2026-03-25
+
+### Summary
+
+Git-board rewrite — library composition capstone. Rewrites git-board from
+a self-contained monolith into a library consumer of gitea-client, proving
+the full extension architecture end-to-end: lib.require(), connections,
+dependencies, multi-file Starlark, and connection type discovery. Includes
+5 platform bug fixes found during composition testing.
+
+### Changed
+
+- **git-board v0.2.0:** Rewrote Starlark backend to delegate all Gitea API
+  work to gitea-client library via `lib.require("gitea-client")`. Removed
+  `api.http` permission, platform abstraction, and per-user token settings.
+  Added `connections.read` permission and `gitea-client >= 1.0.0` dependency.
+  Surface JS: replaced TokenSetup with ConnectionSetup screen.
+  (~130 lines, down from ~329)
+- **gitea-client v1.0.1:** Added missing fields to `get_issues()` (created_at,
+  updated_at, html_url) and `get_prs()` (created_at, html_url, mergeable).
+  Re-exported loaded sub-module functions via explicit global assignment for
+  lib.require() compatibility.
+
+### Fixed (platform bugs)
+
+- **ext_api.go:** Route handler no longer requires `api.http` for all packages
+  with API routes. Consumer packages that delegate HTTP to libraries don't
+  need `api.http` themselves.
+- **packages.go:** `InstallPackage` handler now calls `SyncManifestPermissions`
+  so permission rows are created on package install (was only in the legacy
+  `AdminInstallExtension` handler).
+- **runner.go:** Package loader for `load()` sub-modules now injects the `json`
+  module into predeclared scope, matching ExecWithLoader behavior.
+- **connection_resolver.go:** Added panic recovery around `vault.Decrypt` to
+  prevent goroutine crashes from invalid nonce lengths after vault key rotation.
+
+### Added
+
+- **SDK test runner:** `git-board.js` domain (14 tests) — validates multi-file
+  library install, connection type registration, consumer dependency, tool
+  registration, consumers list, uninstall protection, connection CRUD, full
+  cleanup cycle.
+
 ## [0.38.2.0] — 2026-03-25
 
 ### Summary