chore(release): 0.96.0

[soustruh]

Release 0.96.0

22 changes since 0.95.0. Four of them, in three PRs, break existing use, and each has a migration step in the changelog.

• feat(data-app)!: copy the password instead of printing it, also after create/deploy --wait (CLI-23) #813 (CLI-23), BREAKING: data-app password no longer prints the password. In a terminal, c copies it to the clipboard. Without a terminal, --copy copies it and --reveal prints it. The command needs no Manage API token. create --wait and deploy --wait take the same flags.
• fix(sync): push deletes only with --force and skips remote-deleted configs (#792 G, H) #811 (Pilot: formal verification (TLA+ / Lean) of the sync engine and other data-loss-critical state machines #792 G, H), BREAKING: sync push deletes remote configs and rows only with --force. It no longer creates again a config that someone deleted on the remote after the last pull.
• feat(project): accept a project ID in --project and other alias options (CLI-22) #812 (CLI-22): --project and the other alias options also take a project ID.
• fix(branch): report the branch each command uses, from one place (#766) #800 (branch use: active branch persists silently across sessions and is never echoed on config read/write, so config update can target a dev branch unnoticed #766): each command reports the project and branch that it uses: a Target: line, and targets in --json. --branch 0 means production in every command.
• feat(sync): opt-in sync of shared SQL workspaces in pull, diff, push and clone (CLI-25) #815 (CLI-25): opt-in sync of shared SQL workspaces. BREAKING: sync push --force has the destructive permission class, so an allow-list must name sync.push --force.
• fix(sync): remap shared-code, orchestrator and schedule links, add clone warnings (CLI-24) #814 (CLI-24): sync clone sets the new IDs in the links of shared code, schedules, legacy orchestrations and task rows, and gives warnings.
• feat(sync): clone recreates the target's storage buckets by default #785: sync clone creates the storage buckets that the target does not have.
• feat(data-app): make python-js the default everywhere, incl. type-less sync creates #783: sync push and sync clone create a data app with no recorded type as python-js, not as streamlit.
• fix(sync): pull never deletes a dir it wrote or a locally edited dir (#792 A, C) #796, fix(sync): pull protects local edits in companion files, not only _config.yml (#792 B) #795, fix(sync): promoting main/ to a dev branch is idempotent (#792 D) #794 (Pilot: formal verification (TLA+ / Lean) of the sync engine and other data-loss-critical state machines #792 A–D): sync pull no longer deletes a re-created or locally edited directory, and no longer overwrites edits in companion files. A repeated promote push no longer creates more dev copies.
• fix(sync): create data apps in the push branch after sync clone --branch (#808) #810 (sync push after "sync clone --branch" creates data apps in production #808): after sync clone --branch, sync push creates data apps in the dev branch, not in production.
• fix(update): retry the Windows self-update in copy link mode after a hardlink error (#786) #789 (Self-update triggered mid-session leaves kbagent completely uninstalled (worse than #771's stale-version case) #786): on Windows, the self-update retries with --link-mode copy after a hardlink error.
• fix(workspace): read the transformation from the active branch in from-transformation #809 (workspace from-transformation reads the transformation from production but creates the workspace in the active branch #807): workspace from-transformation reads the transformation from the branch where it creates the workspace.
• fix(data-app): page through GET /apps so list finds apps beyond the first page (#798) #803 (data-app list returns no apps when the first /apps page holds only workspaces (no pagination) #798): data-app list reads every page of GET /apps.
• fix(job): fetch log tail for nested jobs by job id, not dotted runId (#787) #788 (job detail --log-tail-lines returns an empty log for nested jobs (events queried by dotted runId) #787): job detail --log-tail-lines returns the events of nested jobs.
• feat(changelog): show every BREAKING headline in the default changelog view #818: kbagent changelog shows the first sentence of every BREAKING note by default, and at least two notes for each version.
• test(sync): formal verification pilot of the sync engine (#792) #793, test: make false-passing negative controls fail on regression (#790) #797, test: add ratcheting API call-count tests for hot commands (#802) #804, chore(deps): bump undici from 6.28.0 to 6.28.1 in /web/backend #806, test: close gaps found in the post-merge reviews of #797, #803 and #804 #816: housekeeping. A formal model of the sync engine, tests that fail when the guarded behavior breaks, API call-count tests, and an undici update in the web backend.

This PR bumps the version to 0.96.0 and adds the changelog entry. It resolves the vNEXT doc tags to 0.96.0 and runs version-sync (plugin.json / marketplace.json / uv.lock). It also replaces by hand the vNEXT in the docstring of generate_promotion_pipeline.py, which vnext-resolve does not scan. No whatsnew.ts entry: the only UI change is the description of the Data Apps page, which now says Python/JS instead of Streamlit (#783).

Plugin files changed: plugin.json, keboola-expert.md, the SKILL.md of kbagent-cicd-migration and kbagent-promotion-pipeline, generate_promotion_pipeline.py, gotchas.md, commands-reference.md, branch-workflow.md, data-app-workflow.md, permissions-workflow.md, sync-workflow.md, sync-rows-workflow.md, workspace-workflow.md.

make check, make vnext-check and make release-scope-check pass. make test-e2e did not run (no E2E credentials).

After merge: tag the merge commit v0.96.0 to trigger the release pipeline (PyPI + native binaries + GitHub Release).

[keboola-pr-reviewer-bot]

Verdict: auto_approve (risk 1/5) · profile _default

Clean release PR for 0.96.0: version bump plus mechanical vNEXT→0.96.0 resolution across docs and plugin files, no runtime logic changes.

[zajca]

No actionable findings were found by the automated review.

Dismissing prior approval — a new commit was pushed and this review was for an earlier SHA. Run @keboola-pr-reviewer-bot review to get a fresh verdict.

[keboola-pr-reviewer-bot]

New commit on 3d6872a — dismissed 1 stale bot approval. Comment @keboola-pr-reviewer-bot review when you want a fresh review.