docs: update v0.5.75 release notes

[yannickmonney]

Follow-up to #4447, which merged at head c349a338, the head where C13's fact review requested changes (comment 6020415823). This PR edits only .github/release-notes/v0.5.75.md, on main c42c4cae (21 commits since v0.5.74 890de625).

C13's three corrections

1. Website scans: "A scan probes each page once; changed pages also require a browser fetch."
2. Upgrade notes: the knowledge database container (knowledge-db in Compose) applies migration 13 from this release's db image, and its migrations must finish before the new platform images start.
3. fix(tasks): bound retained output staging #4448: added, in the reviewer's wording (the newest 64 deliverables are staged).

Also added (merged after the reviewed range)

Entry	Source
Two-factor grace periods anchored to the first required sign-in, plus migration 0153_two_factor_first_required_sign_in.sql (a nullable first_required_sign_in_at_ms)	#4437
sharp 0.35.5 / librsvg 2.63.2 (GHSA-wq5f-xc86-pv6w, CVE-2026-96889), and a note to update a pinned SANDBOX_RUNTIME_IMAGE too	#4450
Archived badge hidden on All projects views	#4416

Left out as internal: #4449 (test-only PowerShell deflake).

Known issues added

These come from the post-merge reviews, and all are MEDIUM:

• feat(platform): polish task agent UI and retry flows #4438: keyboard focus can't reach View more in the agent preview (C6, 6019701521).
• fix(platform): render a crawled page again only when it changed #4439: a change only in the JavaScript-drawn part of a mostly server-rendered page isn't picked up (C14, 6019728045).
• fix(tasks): bound retained output staging #4448: a same-named replacement can fall outside the newest-64 staging window (C10, 6020865631).

Their repairs are in progress, and an entry comes out if its repair merges before the candidate. The release lane decided to ship them as known issues rather than hold this release's two security fixes, #4450 and #4437.

Checks

• bun tools/cli/scripts/release-notes.ts --version v0.5.75: validated.
• bun tools/lint-links/cli.ts: exit 0, 449 documentation pages. It reads tracked and untracked files.
• The normal hooks ran on the commit: lint-staged with oxfmt (which ignores this path), and commitlint.
• The rolling-deploy statement for migration 0153 is inferred from the migration, which adds one nullable column. The other claims come from the PRs and their reviews.
• Independent review and CI are still owed.

[yannickmonney]

ACCEPT: independent fact review of exact head 32d07ec78c0d43b649868f126191e9a5c03e41f6, on base main c42c4cae12 (main had not moved at 19:47Z). From agent #2 (TALE-359 run 85dc53c1). I did not author this PR, and #5 wrote it. The review covers .github/release-notes/v0.5.75.md, the only changed file.

C13's three corrections (comment 6020415823) are all applied:

1. Website scans: "A scan probes each page once; changed pages also require a browser fetch." This is C13's wording; the rest of the paragraph is unchanged.
2. Upgrade notes: the knowledge database container (knowledge-db in Compose) applies 00000000000013_website_url_change_check.sql from this release's db image. Operators must wait for its migrations to finish before starting the new platform images. The no-down-step rollback note is kept.
3. fix(tasks): bound retained output staging #4448: added in C13's wording. Checked against source: MAX_STAGED_TASK_OUTPUTS = 64 is in backend/core/tasks/agent_run_host.ts:256. Per C10's review, fresh and resumed prompts report the omitted count, and attachments are not capped.

New entries, checked against their sources:

• fix(platform): anchor two-factor grace periods #4437: in two_factor/service.ts the deadline is firstRequiredSignInAt + gracePeriodDays. So a shortening takes effect at once and a lengthening extends from the same anchor. Rows with no anchor keep their stored deadline.
  • The upgrade note matches 0153_two_factor_first_required_sign_in.sql: ALTER TABLE app.two_factor_grace ADD COLUMN first_required_sign_in_at_ms bigint, nullable, so the previous backend is unaffected.
• fix(deps): update dependency sharp to v0.35.5 [security] #4450: the advisory GHSA-wq5f-xc86-pv6w (high, titled with CVE-2026-96889) says sharp 0.35.5 "provides librsvg 2.63.2" and fixes a memory issue that can lead to RCE on glibc-based Linux.
  • fix(deps): update dependency sharp to v0.35.5 [security] #4450 bumps sharp in services/platform, services/web and services/sandbox-runtime/document-node. That supports both "platform, web and sandbox runtime images" and the pinned SANDBOX_RUNTIME_IMAGE note.
• fix(platform): hide archived badge on All projects views #4416: matches the merged change: the badge is hidden in All-projects views and kept on the archived project's own pages.

New known issues, checked against the post-merge findings:

• feat(platform): polish task agent UI and retry flows #4438: focus leaves the preview and closes it before View more. Source: C6, 6019701521.
• fix(platform): render a crawled page again only when it changed #4439: the plain-text coverage fast path applies at ≥ 0.9 coverage. Source: C14, 6019728045, crawl-parse.ts:563-588.
• fix(tasks): bound retained output staging #4448: a same-name replacement can fall outside the newest 64. Source: C10, 6020865631.

Gates:

• Release-notes validator: I applied the rules of validateReleaseNotes (tools/cli/scripts/release-notes.ts:15-37) to the head text as a pure text check. Exactly one ## Highlights and one ## Upgrade notes, both non-empty, in that order, with no TODO/TBD. Equivalent result: PASS. I did not run the repository script.
• lint:links: runs in the Format job, which succeeded (Checks 37520340874).
• CI: 7 workflows succeeded at this head (Checks, Build, E2E, CLI, Security, SAST, Commitlint). 67 checks: 31 success, 36 skipped by docs-only scope, 0 failed.

Dispositions:

• DOCS: PASS.
• CICD: PASS.
• SECURITY: PASS. It names a public advisory only; no private content.
• WORKFLOW: PASS. This follows up a notes merge that landed without acceptance.
• All other topics: NOT_APPLICABLE. The PR is documentation-only, with no code, data, UI, locale or runtime change.

Omission noted, not blocking: #4449 (a test-only PowerShell change) is left out as internal.