Promote verified develop release to main

[Serph91P]

Summary

Promotes the current verified develop head to main for the next stable StreamVault release.

Candidate head: d043043a20bb373dd5c49f21274e964e71f19e20
Current main base: 6d12ace0a41dfcd2df7f06026d3e0a8fa19b699a

This promotion includes the completed dependency updates and the filesystem path containment fixes from PR #746. The current candidate is published as development release v2.13.14-dev.

Verification

• Tests completed successfully on the exact candidate head: https://github.com/Serph91P/StreamVault/actions/runs/30733094599
• Security Scanning completed successfully on the exact candidate head: https://github.com/Serph91P/StreamVault/actions/runs/30733094600
• Release and Docker Build completed successfully on the exact candidate head: https://github.com/Serph91P/StreamVault/actions/runs/30733094603
• CodeQL completed successfully on the exact candidate head: https://github.com/Serph91P/StreamVault/actions/runs/30733094628
• Pull request checks completed successfully on the exact candidate head: https://github.com/Serph91P/StreamVault/actions/runs/30733095984
• Refresh integration PR Refresh develop promotion with current main #758 incorporated the current main history without changing the candidate tree
• Final independent exact-head acceptance will complete before this PR leaves Draft state

Release gate

After merge, the stable release, published image tags, digest equality, and the new default-branch CodeQL analysis must be verified against the exact main merge commit.

[Serph91P]

Blocking review finding for exact head d043043a20bb373dd5c49f21274e964e71f19e20 against base 6d12ace0a41dfcd2df7f06026d3e0a8fa19b699a: the PR body still identifies e1ca0a8fa0aa89c79583b317b12556fcec56f00c as the candidate head and v2.13.13-dev as the published development release. The live candidate is d043043a20bb373dd5c49f21274e964e71f19e20, and v2.13.14-dev targets that exact commit. Please update these references before the final exact-head review is repeated.

[Serph91P]

Final exact-head review: no blockers at d043043a20bb373dd5c49f21274e964e71f19e20 against main at 6d12ace0a41dfcd2df7f06026d3e0a8fa19b699a.

This supersedes the previous stale-metadata finding. The corrected PR body now records the exact head, base, current 36 of 36 successful checks, and prerelease v2.13.14-dev, with no stale head or release reference.

Evidence:

• Reviewed the complete 26-commit, 9-file delta from a clean detached checkout. The five filesystem sinks now enforce canonical containment, including boundary, traversal, and symlink cases, while preserving valid paths. The full Python 3.14 suite passed 165 tests and the focused security suite passed 24 tests.
• Migrations, Ruff check and format check, pip audit, Node 24 install, token lint, type check, production build, npm audit, Docker build, container health, API and frontend smoke, diff hygiene, secret scan, conflict scan, and typography scan all passed. ESLint reported 0 errors; its 167 warnings are in unchanged frontend source.
• v2.13.14-dev targets the reviewed head. All four GHCR and four DockerHub development tags resolve to sha256:63207b428187cd344c5d85c0a2d0545d86630f9ca6eaaa0bdcc7f597d1e70730, and both registries expose the exact revision label.
• The PR remains OPEN and Draft, MERGEABLE and CLEAN. The active main ruleset allows a normal merge commit and requires neither an approval nor conversation resolution; there are no unresolved review threads.

Verdict: the corrected promotion candidate is clean for the Ready-for-review handoff.