[Hexecu]

Summary

• Add a read-only Amazon Athena connector using an AWS SSO profile, optional assumed IAM role, and selected workgroup, with bounded browsing and query results.
• Let an unreadable saved AI credential be replaced without deleting its provider profile or other vault entries.
• Add a cell context menu: view the full value, copy the value, or copy the row as JSON. Support Shift+F10/ContextMenu and Escape.
• Update dependencies and Electron notices, document exact source references for the 0.2.2 release, and fix macOS packaging in PR CI.

Verification

• npm test: 343 passed, 2 skipped. npm run test:i18n: 5 passed. npm run build, packaged platform smoke, and all five locale flows passed locally.
• npm run audit: zero production findings. A single moderate minimatch advisory in development-only build tools is allowlisted through 2026-11-30; every other finding remains blocking.
• Earlier Developer ID signed macOS arm64 package passed deep/strict signature and source checks. Packaged desktop e2e: 18 passed, 0 failed, 1 expected block because the standard suite excludes native credential acceptance.
• A renewed live AWS SSO session let the signed app code connect to both Athena profiles, load their schemas, and read one row from each. No private query results are included here.

Release status

The final notarized build and GUI acceptance must use the latest commit. The previous signed QA package predates the notice and audit updates. The Apple notarytool credential is being prepared; no public 0.2.2 binary is attached or installed yet. The source manifest is in docs/releases/0.2.2-sources.md.