[BaaRai]

Prepares the v0.5.0 release: moves the [Unreleased] entries into a [0.5.0] - 2026-11-04 section of CHANGELOG.md and adds the changes merged since v0.4.0.

• Covered PRs: ollama support #128, fix(security): remove startup secrets from the environment before child processes spawn #136, fix(auth): require a setup token for /api/auth/init and bind 8787 to localhost #137, fix(gitignore): ignore backups/ again #138, fix(backup): reject --keep 0 #139, fix(agent): match ARTEX_LLM_PROVIDER case-insensitively #140, fix(config): fail on malformed config.json; escape values in install.sh #141, fix(llm): send a saved API key only to the endpoint it was saved for #142, fix(docker): install Node 22 in the runtime image #143, ci: add go test -race and shellcheck #144, build: go 1.26.10 and golang.org/x/net v0.62.0 #145, fix(security): apply New options so the secret scrub actually runs #146, fix(docker): build the image from source so a fresh clone builds #147. Closed-without-merge PRs (docs: AI PR review REA analysis (superseded) #122, fix(docker): build from source and verify tool downloads #126, fix(docker): compile the binary inside the image so a fresh clone builds #133, fix(security): drop startup secrets from the environment before agents spawn shells #134, fix(auth): require a setup token for /api/auth/init and bind 8787 to localhost #135) are not listed.
• Three changes landed on main without a pull request (1ed154e, 1c35c9c, 0477751); their entries cite the commit and say "direct commit".
• A Known issues subsection lists what is still open, including the JWT key being written to /app/jwt.key (outside the /app/data volume) in the Docker image.
• Version: 0.5.0, a minor bump, because the release adds features (Ollama profiles, setup token, ARTEX_BIND_ADDR) with no removal of public API.

Changelog-only change; no code is touched.