Release CX: stage-batch8 — 2-PR batch (v0.51.126) — kanban markdown + live activity timeline

[nesquena-hermes]

Release CX — v0.51.126 — stage-batch8 — 2-PR batch

Two contributor PRs, both frontend-only, Opus-cleared as SHIP.

PR	Author	LOC	Surface	Risk
#2819	humayunak	+178/-7	static/panels.js kanban markdown	low — scoped to kanban panel, esc-first XSS-safe
#2847	AJV20	+147/-6 (squashed from 2)	static/ui.js activity timeline	low — collapsed-default preserved, frontend-only

Cherry-picks

7983e025 kanban: full markdown rendering for task description and comments (#2819)
237bab75 feat: surface live activity timeline (#2847 — squashed from 2 commits)
68af4399 Stamp CHANGELOG for v0.51.126

Pre-Opus gate

Check	Result
node -c on touched JS	PASS
Merge-marker grep	clean
4 new + 95 existing kanban tests	pass in isolation
Full pytest	6352 passed, 7 skipped, 0 failed (up 4 from 6348)

Opus advisor verdict

Both safe for v0.51.126.

• feat(kanban): full markdown rendering for task descriptions and comments #2819: Scoped to kanban; XSS surface clean (esc-first + scheme-restricted links). Optional follow-up: replace _kanbanRenderMarkdownInline(lang) with esc(lang) at panels.js:1264 — purely defense-in-depth, not blocking.
• feat: surface live activity timeline #2847: Frontend-only; collapsed-default + user-intent + localStorage state preserved; 90s idle threshold is hardcoded but reasonable. If PMs care about a 30s "still alive" cue, file as follow-up — not a regression.

What's NOT in this batch

Still queued:

• fix(workspace): fallback for large markdown previews #2828 (already closed as superseded by fix(workspace): fall back for large markdown previews #2829)
• style(composer): clamp composer-box max-width so wide displays don't squeeze footer chips #2812 composer max-width (UX-review path)
• feat: add shutdown button to WebUI title bar #2824 shutdown button — visible UI + destructive action, needs auth thinking
• fix(sessions): keep pin state authoritative #2830 pin state — server fix good, client UX regression (removes inline limit indicator)
• perf(http): enable HTTP/1.1 keep-alive #2836 HTTP/1.1 keep-alive — touches auth.py + many endpoints
• feat: polish installed PWA startup #2842 PWA polish — modifies sw.js service worker, high cache-poisoning risk
• fix(webui): keep context-engine guidance model-facing #2825 context-engine guidance — non-trivial scope
• fix(state-sync): pass profile explicitly so background-thread DB writes hit the right state.db (#2762) #2827 state-sync profile kwarg — api/state_sync.py background-thread DB writes
• fix(webui): route Cursor ACP and gate reasoning effort by model #2792 / feat(runtime): wire runner route selection harness #2794 / feat: add Kanban consolidated view toggle #2814 / feat: PATCH /api/mcp/servers/{name} — enable/disable toggle #2776 / feat(i18n): add Turkish (tr) locale #2772 / feat: add Auxiliary Models settings card #2680 / Add scoped workspace Artifacts tab #2673 — each needs its own review path