Release CW: stage-batch7 — 10-PR low-risk batch (v0.51.125) — UI polish + bug fixes + diagnostics

[nesquena-hermes]

Release CW — v0.51.125 — stage-batch7 — 10-PR low-risk batch

Big batch from the May 24 sweep. 10 contributor PRs, all well-tested, all pre-cleared by Opus advisor as SHIP. Mix of UI/UX polish, bug fixes, diagnostics improvements, and a duplicate-PR resolution.

Cherry-picks

2e876ea2 fix: kanban worker log URL double query param (#2839)
618e1a5d fix(server): tolerate malformed request logging (#2832)
32df5546 fix(webui): prevent approval and clarify cards stealing focus (#2818)
9a5973a6 feat: echo clarify user choice as visible message (#2820)
7a3ceacf fix(composer): stop chip wraps from compressing past content (#2826, closes #2740)
b6f7412b Add option to ignore Agent updates (#2843)
67a20477 fix(csrf): clarify rejection diagnostics (#2837)
f1586daa fix(cron): surface gateway scheduling guidance (#2838)
99c886c1 fix(workspace): open rendered preview links correctly (#2834)
70402f96 fix(workspace): fall back for large markdown previews (#2829, supersedes #2828)
ded51675 Stamp CHANGELOG for v0.51.125

PR	Author	LOC	Surface	Risk
#2839	tn801534	+1/-2	static/panels.js kanban URL	very low
#2832	franksong2702	+6/-2	server.py log_request	very low
#2818	humayunak	+6/-2	static/messages.js focus guard	very low
#2820	tangerine-fan	+10/-0	static/messages.js clarify echo	very low
#2826	Koraji95-coder	+16/-5	static/style.css chip wraps (squashed 2 commits)	low
#2843	AJV20	+103/-6	Settings: ignore agent updates	low
#2837	franksong2702	+109/-1	api/routes.py CSRF diagnostics	low
#2838	franksong2702	+85/-2	Tasks panel gateway warning + docs	low
#2834	franksong2702	+136/-4	workspace preview links	low
#2829	franksong2702	+103/-1	workspace large MD fallback	low

Supersedes

#2828 by Raven7979 — same scope as #2829 (large markdown preview fallback). Picking #2829 because: named constants with semantic names, helpers extracted, status message includes size+lines, dedicated test file with 5 cases. Will close #2828 as superseded.

Conflict resolution

10 PRs across api/routes.py + 3 static JS files + style.css. The only real merge conflict was #2826 (PR has 2 commits, the 2nd was a Copilot review fixup that assumed the 1st was applied) — used git merge --squash to apply both as one commit. Everything else was clean cherry-pick with only CHANGELOG conflicts (resolved by keeping ours).

Pre-Opus gate

Check	Result
Python ast.parse + node -c on all touched	PASS
Merge-marker grep	clean
13 PR-specific tests + 54 mobile layout tests + 115 batch_fixes/sprint20b/streaming_markdown	all pass in isolation
String-assertion risks (chip-wrap rules in test_mobile_layout)	verified — mobile rules unchanged
Full pytest	6348 passed, 7 skipped, 0 failed (up 15 from 6333)

Opus advisor verdict

Overall: SHIP all 10 — stage-batch7 / v0.51.125 is release-ready. All four risk areas verified-safe under inspection; no HOLD-class issues.

• fix(composer): stop chip wraps from compressing past their content (#2740) #2826 (chip overflow): "Intended overflow-x:auto behavior, mobile breakpoints intact, tested."
• fix(workspace): open rendered preview links correctly #2834 (HTML preview): <base> injection is XSS-safe (static literal); popup-escape sandbox is the deliberate trade-off, iframe sandbox preserved.
• fix(csrf): clarify rejection diagnostics #2837 (CSRF attr): Handler-attr safe due to clear-on-entry.
• Add option to ignore Agent updates #2843 (ignore agent updates): Flag scope is correct — compatibility detection unaffected. Only suppresses update notices.

What's NOT in this batch

Still queued for review:

• fix(workspace): fallback for large markdown previews #2828 (duplicate of fix(workspace): fall back for large markdown previews #2829) — will close as superseded
• perf(http): enable HTTP/1.1 keep-alive #2836 HTTP/1.1 keep-alive — touches auth.py + many endpoints, perf with risk
• style(composer): clamp composer-box max-width so wide displays don't squeeze footer chips #2812 composer max-width — UX-review path with screenshots
• fix(webui): keep context-engine guidance model-facing #2825 context-engine guidance — non-trivial scope
• fix(state-sync): pass profile explicitly so background-thread DB writes hit the right state.db (#2762) #2827 state-sync profile kwarg — api/state_sync.py background-thread DB writes
• fix(sessions): keep pin state authoritative #2830 pin state authoritative — api/routes.py write path
• feat: PATCH /api/mcp/servers/{name} — enable/disable toggle #2776 MCP PATCH endpoint, fix(webui): route Cursor ACP and gate reasoning effort by model #2792 Cursor ACP, feat(runtime): wire runner route selection harness #2794 runner harness, feat: add Kanban consolidated view toggle #2814 Web Agent tools, feat(i18n): add Turkish (tr) locale #2772 Turkish locale, feat: add Auxiliary Models settings card #2680 Auxiliary Models, Add scoped workspace Artifacts tab #2673 Artifacts tab — each needs its own review path
• All held/maintainer-review PRs — separate process