fix: webui auto-update silent failure + bump to v0.5.9

fix: webui auto-update fails after rebuild + bump to v0.5.8

fix: auto-update fails after container rebuild

新增：终端沙箱隔离层（灵感来自 OpenAI Agents SDK Sandbox Agent）

修复：过滤模型思考标签 <|channel>thought / <channel|> 泄漏到用户界面

feat: add DuckDuckGo free fallback for web_search (no API key needed)

fix: version display v0.12.0 + auto-inject MEDIA: from execute_code

feat: pin hermes-agent v0.12.0 + runtime auto-update

feat: auto-update hermes-web-ui at runtime

feat: add 空性智慧顾问 - 儒释道三教合一智慧导师

fix: set TZ=Asia/Shanghai for correct log timestamps

feat: integrate agency-agents-zh — 211 expert roles for instant role switching

feat: persist WeChat credentials via HF Space Secrets + account JSON

fix: restore WEIXIN_TOKEN from persisted account file on startup

fix: eliminate gateway dual-start race condition

security: mask all secrets in build logs (start.sh)

security: generate .env from Space Secrets, remove .env from build

feat: auto-register lifecycle-heartbeat cron on startup

feat: add lifecycle heartbeat system (ClawdChat-inspired)

fix: persist .env and config.yaml across container rebuilds

fix: WeChat session persistence - auto-reconnect after gateway restart

force rebuild v3

fix: robust gateway restart — force-kill residual processes before restart

fix: start.sh

fix: persist WebUI credentials + auto-setup on startup

fix: add Python-based gateway watchdog inside entry.py

fix: bind api_server to 127.0.0.1 + fix watchdog process detection

fix: add gateway watchdog + stale PID cleanup + retry logic

feat: integrate hermes-web-ui BFF server

revert: restore pure Python setup (remove Node.js build dependency)

fix: hermes-web-ui build (add esbuild) + dual-process (gateway + Node.js BFF)

feat: integrate MemPalace memory palace + MCP + SOUL.md instructions

fix: correct CLI import (cli->main), add start.sh for persistent symlinks