release(final): finalize v1.0.19 release and update release_log for v1.0.19

Details:

- Document embedded WorkerPal sandbox image preparation on both cold-start and already-healthy runtime attachment paths.

- Document the shared embedded WorkerPal image precheck that reuses the Docker precheck environment and resolves the runtime tag once.

- Document propagation of PUSHPALS_RUNTIME_TAG into embedded runtime child environments so WorkerPals can validate sandbox image freshness against the active runtime release.

- Document DockerExecutor sandbox image rebuild behavior for missing, unlabeled, or stale local images before registry pull fallback.

- Document removal of bun.lockb from text-based runtime source downloads to avoid corrupting binary lockfiles in the sandbox build context.

- Document tracked-file-only sandbox packaging so packaged runtime assets do not pick up ignored local artifacts such as __pycache__.

- Document sync-cli-runtime-assets changes that build the packaged sandbox tree from tracked repo files and only include bun.lock when present.

- Document expanded CLI runtime bootstrap coverage for runtime-tag propagation, tracked-only sandbox copying, attached-runtime image prep, and source-download behavior that skips bun.lockb.

Author: PiyushDatta

release_log.md

@@ -2,22 +2,21 @@
 
 ## Release Metadata
 
-- version: `v1.0.18`
-- start_commit: `6ca6aa8c35faf681b2f9c4111d1ec369d46fc337`
-- end_commit: `6ca6aa8c35faf681b2f9c4111d1ec369d46fc337`
+- version: `v1.0.19`
+- start_commit: `17350c390e108bac71f0815c8c3d8cd17aa19112`
+- end_commit: `17350c390e108bac71f0815c8c3d8cd17aa19112`
 - commits_in_range: `1`
 
 ## Highlights
 
-- Fail CLI startup and healthy-runtime attachment when no idle WorkerPal capacity is available instead of treating merely online or busy workers as ready.
-- Add and reuse a shared WorkerPal capacity timeout calculation so startup, preflight, and post-connect readiness checks use the same contract.
-- Preserve prechecked absolute Git and Docker binaries when rebuilding the embedded runtime environment so SourceControlManager and WorkerPals use the exact validated executables.
-- Run the Docker-backed WorkerPal precheck before startup and carry the resolved Docker binary into the embedded runtime path.
-- Update RemoteBuddy startup capacity enforcement to wait for an idle worker and surface a clear unavailable reason when workers remain online but busy.
-- Make DockerExecutor consistently spawn the resolved Docker executable for inspect, run, build, pull, image-inspect, logs, restart, and availability probing.
-- Restore backward compatibility for legacy autonomy component budget aliases like `apps_server` and `apps-server` while still allowing arbitrary repo-relative component keys.
-- Extend CLI bootstrap and invocation tests for resolved Docker env propagation, busy-worker readiness failures, and healthy-runtime worker capacity gating.
-- Add shared config regression coverage for legacy autonomy component alias parsing.
+- Move embedded WorkerPal sandbox image preparation out of the cold-start-only path so the CLI also repairs or validates the local Docker image before attaching to an already-healthy same-repo runtime.
+- Add a shared embedded WorkerPal image precheck helper that resolves the runtime tag once, reuses the Docker precheck environment, and keeps startup and attach behavior on the same contract.
+- Propagate `PUSHPALS_RUNTIME_TAG` into embedded runtime child environments so WorkerPals can verify whether a local sandbox image matches the active runtime release.
+- Teach DockerExecutor to rebuild the local WorkerPal sandbox image when the local image is missing, unlabeled, or stale for the current runtime tag before falling back to registry pulls.
+- Stop treating `bun.lockb` as a text runtime asset in GitHub source-tag downloads to avoid corrupting binary lockfiles in the sandbox build context.
+- Replace recursive sandbox source copying with tracked-file-only copies so packaged runtime assets do not pick up ignored local artifacts such as `__pycache__` or other machine-specific junk.
+- Update `sync-cli-runtime-assets` to build the packaged sandbox tree from tracked repo files and only include `bun.lock` when present.
+- Extend CLI runtime bootstrap coverage for runtime-tag propagation, tracked-only sandbox copying, embedded image prep on attached runtimes, and source-download behavior that skips `bun.lockb`.
 
 ## Install
 
@@ -48,5 +47,5 @@ bun install -g @pushpalsdev/cli
 ## Release Checklist
 
 - Confirm `release_log.md` content before tagging.
-- Tag and push: `git tag v1.0.18 && git push origin v1.0.18`.
+- Tag and push: `git tag v1.0.19 && git push origin v1.0.19`.