chore(release): cut 0.9.4

[danielmeppiel]

TL;DR

Cuts release 0.9.4 — bumps pyproject.toml, finalises the CHANGELOG.md Unreleased section, and reassigns open 0.9.4 milestone issues to 0.9.5.

What ships in 0.9.4

8 PRs merged since v0.9.3 (audited against git log v0.9.3..HEAD):

Added

• feat(install): SKILL_BUNDLE -- day-0 install parity with npx skills add #974 SKILL_BUNDLE — day-0 install parity with npx skills add, with --skill <NAME> subset selection persisted in apm.yml + apm.lock. Bare apm install is deterministic across re-runs; apm audit --ci detects manifest↔lockfile drift.
• feat(ci): automate apm-triage-panel on new and reopened issues #954 Automated apm-triage-panel workflow — daily oldest-first sweep (max 10 issues) plus on-demand status/needs-triage fast path. Recompiles all gh-aw workflows on v0.68.3.

Changed

• docs(python-architect): document mermaid classDiagram :::cssClass GitHub-render trap #970 python-architect agent now documents the GitHub-render trap where classDiagram rejects inline :::cssClass shorthand on relationship lines.

Fixed

• fix(install): honour REQUESTS_CA_BUNDLE in package validator #911 TLS validation behind corporate proxies: install/validation.py honours REQUESTS_CA_BUNDLE.
• fix(triage-panel): dispatch project-sync per themed issue #971 Triage Panel themed issues now reach the PGS project board via safe-outputs.dispatch-workflow.
• fix(cli): CLI consistency report findings(#903) #910 CLI consistency cleanup from the 2026-04-24 audit ([cli-consistency] CLI Consistency Report — 2026-04-24 #903): apm experimental <subcommand> --help shows subcommand help; flag/help alignment.
• fix(templates): use canonical taxonomy labels in issue templates #958 Issue templates use canonical APM label taxonomy.
• fix(ci): deploy docs after bot-cut releases via workflow_call #953 Docs site auto-deploys after bot-cut releases (docs.yml is now workflow_call).

Milestone hygiene

• Created milestone 0.9.5 (Added ghe support #7).
• Reassigned 41 open issues from 0.9.4 to 0.9.5. The 0.9.4 milestone now contains only the 4 closed issues that actually shipped, ready to be auto-closed by the release workflow.

Validation

• git log v0.9.3..HEAD --pretty=format:"%h %s" cross-checked against CHANGELOG entries — every PR mentioned, no orphan commits except the 3 in-flight fix(triage-panel): ... follow-up commits to PR feat(ci): automate apm-triage-panel on new and reopened issues #954, which roll up under feat(ci): automate apm-triage-panel on new and reopened issues #954's entry per Keep-a-Changelog convention.
• pyproject.toml version bumped: 0.9.3 → 0.9.4.
• CHANGELOG [Unreleased] section preserved (empty) for the next release cycle.

How to test

• Inspect the diff: git diff main..release/0.9.4 -- CHANGELOG.md pyproject.toml.
• Verify milestone reassignment: gh api repos/microsoft/apm/milestones/6 --jq '.open_issues' returns 0; gh api repos/microsoft/apm/milestones/7 --jq '.open_issues' returns 41.
• On merge, the release workflow tags v0.9.4, publishes to PyPI, builds binaries, and (now via fix(ci): deploy docs after bot-cut releases via workflow_call #953) auto-deploys docs.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Cuts the 0.9.4 release by updating the project version and finalizing the changelog entries for the 0.9.4 shipped PRs.

Changes:

• Bump apm-cli version from 0.9.3 to 0.9.4 in pyproject.toml.
• Promote [Unreleased] entries into a new ## [0.9.4] - 2026-04-27 section in CHANGELOG.md, keeping [Unreleased] empty for the next cycle.

Show a summary per file

File	Description
pyproject.toml	Updates package version to 0.9.4 for the release cut.
CHANGELOG.md	Adds the 0.9.4 release section and assigns the shipped PR entries to it.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 2

[Copilot]

pyproject.toml bumps the project version to 0.9.4, but uv.lock still contains an editable apm-cli entry at version 0.9.3. Please regenerate/update uv.lock so the lockfile metadata stays consistent with the project version (this repo appears to track the project itself inside uv.lock).

[Copilot]

The 0.9.4 changelog bullet for #974 is extremely long and reads more like release notes than a Keep-a-Changelog entry. Consider trimming it down to the key user-visible points so the changelog stays scannable and consistent with the "concise, one line per PR" convention used elsewhere in this file.

Suggested change

- **Day-0 install parity with `npx skills add`**: every public repo that installs cleanly with `npx skills add owner/repo` now installs cleanly with `apm install owner/repo`. APM recognises the `skills/<name>/SKILL.md` convention used by `vercel-labs/agent-skills`, `xixu-me/skills`, `larksuite/cli`, and the rest of the agentskills.io ecosystem as a first-class package shape (`SKILL_BUNDLE`). `apm.yml` is OPTIONAL for these packages -- adding it is strictly additive (lockfile + pinning) and never regresses installability. Multi-skill bundles install all skills by default; `--skill <NAME>` (repeatable) selects a subset. The selection is **persisted** in `apm.yml` (`skills:` field) and `apm.lock.yaml` (`skill_subset`), so bare `apm install` is deterministic. Use `--skill '*'` to reset to all skills. `apm audit --ci` detects drift between manifest and lockfile skill subsets. (#974)

- `apm install` now supports the same public skill repos as `npx skills add`, including `SKILL.md` bundles and persistent `--skill` subset selection for deterministic installs. (#974)