What's Changed

• fix(publish): preserve scope in publish attachment key and tarball URI by @pullfrog[bot] in #478
• Fall back to webpki roots and system DNS on Android (no-JVM builds) by @colinhacks in #501
• feat(init): ship nub init — TypeScript-first project scaffold by @colinhacks in #499
• upgrade: support the self-owned channel on Windows by @colinhacks in #506
• pm: run approved build scripts during approve-builds by @colinhacks in #503
• fix(spawn): macOS group-reaper watcher so SIGKILL of the nub process group can't orphan the workload by @colinhacks in #504
• pm: exclude workspace link packages from dedupe diff by @colinhacks in #502
• fix(pm): clamp identity walk-up to nub's cache root for internal scratch installs by @colinhacks in #513
• fix(pm): cache dist-tag resolution and slim registry metadata fetches by @colinhacks in #505
• node install: stream extraction during download, overlap checksum fetch by @colinhacks in #508
• linker: workspace-spanning hoisted planning for nodeLinker=hoisted by @colinhacks in #511
• feat(pm): sanction top-level packageExtensions under nub identity by @colinhacks in #507
• fix(pm): enforce + role-scope packageExtensions under nub identity by @colinhacks in #509
• pm: accept dist-tag specs in update args by @colinhacks in #516
• chore: remove dead code and tighten visibility via cargo-hawk by @colinhacks in #514
• fix(watch): forward explicit --env-file to the watched Node so restarts re-read it by @colinhacks in #510
• fix(spawn): dispatch the parent-death watcher verb above argv0 detection by @colinhacks in #517
• aube: sync vendored engine to upstream v1.32.0 by @colinhacks in #519
• revert(nubx): drop the unified file/script tiers, back to npx parity by @colinhacks in #525
• init: scaffold typescript ^7 as a devDependency by @colinhacks in #526
• fix(pm): export npm_config_user_agent to dlx/create/exec children by @colinhacks in #529