feat: harden server pull deployments and git hygiene

CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.10.0 - 2026-07-28
+
+- Added safe Gitea Server pull with repository-scoped read-only deploy keys and pinned SSH host fingerprints.
+- Automatically discovers and links unique running repository workloads while filtering system containers and stale release folders.
+- Reconciles live server SHA, Gitea SHA and runtime health, including deployments changed outside ForgeFlow.
+- Preserves adopted Compose and DockerMan identity and avoids duplicate repository links.
+- Expanded Git Validator with editor, line-ending, dependency-lock and Gitea Actions checks plus reviewable fixes.
+- Refined the dark deployment workspace with clearer workload identity, focused inventory and motion-safe illustration.
+- Added live connection/deployment audit scripts and kept automatic cleanup of older packaged artifacts.
+
+## 0.9.5 - 2026-07-28
+
+- Added a mandatory remote write-access preflight before every Direct copy deployment and again immediately before upload.
+- The preflight reports the exact failing path, SSH user, owner, group and mode instead of allowing a partial copy or Docker activation.
+- Added an in-app **Check / fix write access** action on every SSH / Unraid deployment and directly beside failed permission checks.
+- The repair is restricted to the linked project source and `.forgeflow` state, assigns the Unraid `users` group where available, preserves executable bits and excludes configured runtime data.
+- Explicit permission repair now also normalizes SMB/manual-copy access even when the SSH account is root and could already write.
+- Direct copy is fail-closed: candidate Compose configuration and images are validated before live files change; no implicit `down`, `--remove-orphans` or `--force-recreate` is used.
+- A failed activation restores the prior source and image tags, attempts to restore the previous runtime and retains rollback evidence for diagnosis.
+- Removed orphan deletion from the legacy server deployment helper as well.
+
+## 0.9.4 - 2026-07-28
+
+- Fixed imported deployments failing with `service has neither an image nor a build context` because a stale labels-only metadata overlay introduced a phantom service.
+- Existing workloads now activate strictly from their real Compose files; ForgeFlow metadata is stored outside the active Compose model.
+- Redeploy always uses `--force-recreate` and verifies every service returned by `docker compose config --services`.
+- A deployment is rejected when the container ID did not change or when the previous hinted container remains running beside a duplicate workload.
+- Deployment SHA is promoted only after recreation and runtime checks complete.
+
+## 0.9.3 - 2026-07-28
+
+- removed every server-to-repository authentication check and all server-side Git deployment branches from SSH/Unraid deploy and rollback;
+- forcibly migrated legacy SSH/Unraid profiles to direct local bundle copy, except explicit monitor-only profiles;
+- discovered Compose YAML definitions directly from configured Unraid appdata roots even when Docker inspection fails;
+- merged YAML definitions with runtime containers, stopped containers and DockerMan templates;
+- automatically linked unique high-confidence Compose folder/project matches and added one-click linking for remaining strong matches with all fields prefilled;
+- made inventory failure handling compatible with strict Bash execution, pruned large runtime folders during YAML discovery and normalized user-share/cache/disk appdata paths.
+
 ## 0.9.0 - 2026-07-27
 
 - replaced Git-checkout-only discovery with a complete Unraid workload inventory, including stopped, Compose, DockerMan and standalone containers;