[gael-obin]

Host tag builds select a source CLI candidate that the installer intentionally refuses on tag refs. The first released-CLI qualification run then reached a separate blocker: the production frontend dependency audit failed. This change selects released CLI 0.1.202 and reuses the existing owner security repair so the normal gates can qualify their combination.

This is a fix at the Host's toolchain and dependency-selection boundaries. It reuses the checksum-pinned released CLI, existing installer and independent default-version assertion; the explicit historical source path and its tag refusal remain. The module guidance now describes the released default accurately.

The security change is the complete five-file owner commit, preserving original authorship and all postimage blobs, including generated next-env.d.ts. It updates frontend and marketing Next.js selections to 16.4.1, frontend Sentry to 10.75.2, and the owner's complete lockfile graph including DOMPurify 3.4.17. No generator output was curated and no audit exception was added.

The broader owner proposal already supplies a source-to-release CLI transition using 0.1.197. This proposal overlaps that work; it deliberately selects the later released 0.1.202, including subsequent secret-store planning and build fixes, while reusing only the complete security commit rather than adopting the telemetry migration. Reassess and remove redundant changes if the owner proposal lands first. A clean merge alone does not qualify the combined selections.

Validation of combined candidate 55272644e11977dd584bec6d91248655811cda6b: the native hosted run completed successfully. Lint, compile, test and build each report nine passed, zero reused/failed/skipped. Sync-drift reports six passed and three explicit unsupported-agent skips, with no changed files for supported services. Accounts and gateway first-party audits are clean; both frontend and marketing production audits report zero vulnerabilities. Every PR repository check, quality aggregate and release-gates aggregate passed, except the correctly inapplicable landed-commit check. GitHub's synthetic merge has the exact reviewed candidate tree. Release-only publication jobs correctly did not run on this PR.

The earlier CLI-only run passed service quality/build but failed the frontend audit; the owner security commit addresses that demonstrated gap. Earlier local evidence includes 130 release-control tests without skips, syntax/naming/boundary checks and successful actual installer execution under Linux amd64 emulation. Those are supplemental to the combined native run.

The candidate was prepared without checking it out over the running development frontend, using a temporary Git index and normal hosted CI. Independent source review verified the complete five owner preimages/postimages, attribution, eight-file scope and factual guide correction; no introduced ownership violation or source defect was identified. Historical preservation evidence contains integration assertions rather than raw before/after hashes; separate raw hashes establish unchanged checkout/index/runtime inputs across the later push only.

This remains a draft. Passing PR CI qualifies this bounded repair, not a supported complete Host release. The existing Host release support investigation remains unresolved: current authority dependencies, owner contract/release reconciliation and consumer conformance evidence need disposition. The older Core adoption proposal is related work, not a substitute for newer required manifest APIs. No gate was weakened; no merge, tag, artifact publication, deployed behavior or consumer acceptance is claimed. This proposal does not close the broader support issue.