Release corbits 0.3.23

[TheGreatAxios]

Cut the 0.3.23 release. DO NOT MERGE here — parent merges after CI green. DO NOT TAG — tag v0.3.23 post-merge.

Commits

• Document 0.3.23 in the changelog (CHANGELOG only: rename Unreleased to 0.3.23, full section)
• Release corbits 0.3.23 (package.json version only)
• Format spawn-agent-worktree.test.ts with current oxfmt (pre-existing drift, formatting-only)

Changelog coverage (main range d498552..origin/main)

Note: the range contains 17 merged PRs, not 18 — see omissions below.

PR	Entry
#922 workflow removal	Removed
#923 provider contextWindow drives occupancy/compaction/meter	Changed
#924 malformed-manifest warnings, swallowed load-error logging	Added
#925 ask_operator unmount on non-TTY exec	Changed
#926 second credential error no longer fails session	Fixed
#927 overlay minimum on short terminals	Fixed
#933 contextWindow no longer sets request max_tokens	Changed
#934 leaf reports always render all four headings	Changed
#935 project approvals file grants need operator confirmation	Changed
#937 unspaced ampersand splits approval segments	Fixed
#938 truncated tool calls fail the turn, retryable	Fixed
#939 stranded admission-window runs settle	Fixed
#940 internal agent traffic out of transcript	Fixed
#941 per-call subjects in coalesced lanes	Added
#942 MCP authorization marker survives re-auth timeout	Fixed
#943 wait_agents exec-primary opt-in	Changed

Conscious omissions

• Fix stale tier-xhard grader hash and guard locked fixtures #936 tier-xhard grader hash + locked-fixtures guard: evals-only, no user-facing behavior.
• Warn when an agent plugin prompt file is missing #928-Restore Gaasbot CTO voice from the GaaS original, keep it off #932 still open/unmerged: not in range.
• Occupancy latch (Stop mailbox-mail occupancy from flooding the send queue #916) and stall re-flush (Re-flush mailbox mail from the fleet stall poll #894): already shipped under 0.3.22, not repeated.
• The brief's 18th issue does not exist in the range — 17 PRs merged since 0.3.22.

Gate

• bunx oxfmt --check . clean repo-wide (1086 files)
• bun run check exit 0 (7034 pass, 0 fail)