Pre-release hardening

Add first-run welcome guide

settings polish: version self-heal, secrets autosave, de-carded rows, full usage table, skills meta + page scroll, mobile fixes

secrets polish: accent names, dirty-aware save, section spacing

hermes digest + HF_TOKEN readiness; secrets section redesign; WAL-aware db change keys

global hermes symlink; shell PATH restore; unified setup hints; aligned agent rows

hf CLI in image; group-scoped creation; needs-setup hints

Notifications UX: iframe guard with direct-URL link, readiness timeout, honest ok:false when no devices subscribed

Agent-initiated push notifications: VAPID+subscriptions, /api/notify (rate-limited), service worker, PWA manifest+icons, Settings enable/test, environment-skill etiquette

Install page v2 (plain title, ready-note, visible code panel) + public-bucket lock gate; OpenClaw onboard-then-chat; Settings agents as rows + manual update path

Overview v2 (groups, markdown expand, working indicator, codex cwd fallback), page landing fix, labelled create fields, boot cover, touch scroll, flat dots

Mobile support: full-screen list/pane navigation, per-agent chip strip for groups, touch sizing; gate skill fan-out to Space envs

Restyle: stroke icon set, mono voice, agent brand-color tints, live brand dot, group rails, motion, terminal empty states, tighter radii

Secrets: filter infra vars; describe each; auto-generate 'environment' skill from descriptions

Detect Space secrets/variables via build-time env snapshot diff (names only)

Grey out Relaunch & update button when no HF_TOKEN is set

Show CLI versions in Settings; add Relaunch & update (factory reboot); pin @latest

Public template: auto-locks at runtime, shows duplicate-to-private widget