[sh1pt-actions-fleet]

What changed

• Keep long-running status aggregators and speech gateways polling for releases after startup.
• Respect update_auto and the C0MPUTE_NO_AUTO_UPDATE opt-out consistently.
• Install TTS and STT runtime prerequisites on worker nodes and recover speech environments even when the host lacks system pip support.
• Keep Piper available when Kokoro cannot install on the host's Python version.
• Bump the CLI, crates, plugins, and release-feed fallback to 0.2.42.

Verification

• cargo build --workspace --all-targets --locked passed with Rust 1.92 in Docker.
• sh -n scripts/install.sh and git diff --check passed.
• Production speech Compose is being updated to put the executable on its writable persistent volume and leave auto-updates enabled.

[github-actions]

ThreatCrush Security Scan

9 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	apps/web/public/sw.js:21
MEDIUM	js-unescaped-html-sink	apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM	js-unescaped-html-sink	apps/web/src/app/layout.tsx:81
MEDIUM	sh-remote-script-execution	scripts/dev-setup.sh:25
MEDIUM	sh-eval-expansion	scripts/dev-setup.sh:35
MEDIUM	sh-remote-script-execution	scripts/install.sh:162
MEDIUM	sh-remote-script-execution	scripts/install.sh:187
MEDIUM	sh-remote-script-execution	scripts/install.sh:305
MEDIUM	sh-remote-script-execution	scripts/install.sh:322

Snippets are redacted; ThreatCrush never prints matched credential material.