release: sync product snapshot to current Muteki runtime

[jiayuqi7813]

Summary

• Sync the public product tree to the current Muteki runtime: Coordinator split, worker roster, pentest collect-N stop, control plane, and Web command deck.
• Keep private research notes, local pentest report JSON, evaluation executors, and the publish scripts out of this snapshot.
• Replace the old worker-settings / artifact / activity UI files with the current Worker orchestration and report surfaces.

Test plan

• ./publish.sh --dry-run from the private source: snapshot scan, Python tests, Go runtime-agent tests, Web tsc + production build
• Dry-run file review: 194 added, 112 updated, 5 product-file deletions (plus ignored local Next out/ artifacts)
• Merge review of deletions: WorkerSettings.tsx, ArtifactPanel.tsx, ActivityStream.tsx, tests/test_llm_live.py, tests/test_identity_migration.py
• After merge, public main install path still runs ./run.sh web

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Dispatch overwrites release image tags
  • Removed the default v0.3.0 value and made the tag input optional so workflow_dispatch falls back to branch name instead of overwriting production release tags.

Or push these changes by commenting:

@cursor push 7a2fc0ab63

Preview (7a2fc0ab63)

diff --git a/.github/workflows/release-images.yml b/.github/workflows/release-images.yml
--- a/.github/workflows/release-images.yml
+++ b/.github/workflows/release-images.yml
@@ -25,8 +25,7 @@
       tag:
         description: "SemVer tag to build, for example v0.3.0"
         type: string
-        required: true
-        default: "v0.3.0"
+        required: false
 
 # 发布任务需要创建 Release 并上传应用包；镜像任务写入 GHCR。
 permissions:

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Branch names can invalidate image tags
  • Added TAG sanitization in all five jobs to replace slashes with dashes before using as Docker image tags or bundle versions.

Or push these changes by commenting:

@cursor push e248797ea0

Preview (e248797ea0)

diff --git a/.github/workflows/release-images.yml b/.github/workflows/release-images.yml
--- a/.github/workflows/release-images.yml
+++ b/.github/workflows/release-images.yml
@@ -50,6 +50,7 @@
           TAG="${{ github.event.inputs.tag }}"
           [ -z "$TAG" ] && TAG="${{ github.ref_name }}"
           TAG="${TAG#refs/tags/}"
+          TAG="${TAG//\//-}"
           echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
       - name: Build application bundle
         run: python scripts/build_release_bundle.py --version "${{ steps.version.outputs.version }}" --repository "${{ github.repository }}"
@@ -75,6 +76,7 @@
           TAG="${{ github.event.inputs.tag }}"
           [ -z "$TAG" ] && TAG="${{ github.ref_name }}"
           TAG="${TAG#refs/tags/}"
+          TAG="${TAG//\//-}"
           [ -z "$TAG" ] && TAG="latest"
           OWNER="${GITHUB_REPOSITORY_OWNER,,}"
           {
@@ -128,6 +130,7 @@
           TAG="${{ github.event.inputs.tag }}"
           [ -z "$TAG" ] && TAG="${{ github.ref_name }}"
           TAG="${TAG#refs/tags/}"
+          TAG="${TAG//\//-}"
           [ -z "$TAG" ] && TAG="latest"
           OWNER="${GITHUB_REPOSITORY_OWNER,,}"
           {
@@ -184,6 +187,7 @@
           TAG="${{ github.event.inputs.tag }}"
           [ -z "$TAG" ] && TAG="${{ github.ref_name }}"
           TAG="${TAG#refs/tags/}"
+          TAG="${TAG//\//-}"
           [ -z "$TAG" ] && TAG="latest"
           OWNER="${GITHUB_REPOSITORY_OWNER,,}"
           {
@@ -275,6 +279,7 @@
           TAG="${{ github.event.inputs.tag }}"
           [ -z "$TAG" ] && TAG="${{ github.ref_name }}"
           TAG="${TAG#refs/tags/}"
+          TAG="${TAG//\//-}"
           [ -z "$TAG" ] && TAG="latest"
           OWNER="${GITHUB_REPOSITORY_OWNER,,}"
           {

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 08810ab. Configure here.}