release: v0.5.0

[askalf]

What

Cuts v0.5.0 — ships the incidents suite + injection-detector hardening that landed in #52/#53 (currently under CHANGELOG [Unreleased]).

• Version bump 0.4.1 -> 0.5.0 (package.json + package-lock)
• CHANGELOG [Unreleased] -> [0.5.0] (2026-07-16)

Minor bump: new user-facing surface (the incidents/ suite + a meaningfully stronger detector), no breaking API change.

After merge: gh release create v0.5.0 --target main then dispatch publish.yml (OIDC trusted publishing) to ship @askalf/fieldpass@0.5.0 to npm.

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer (sprayberry-reviewer bot). This is a verdict-bearing review, not a human sign-off.

Verdict: no blocking issues found — clean, consistent release bump. ✅

---

What I checked

This PR promotes [Unreleased] to [0.5.0] (incidents suite + detector hardening shipped in #52/#53). The change surface is exactly three files:

File	Change
package.json	"version": "0.4.1" → "version": "0.5.0"
package-lock.json	root version + packages[""] version both 0.4.1 → 0.5.0
CHANGELOG.md	inserted ## [0.5.0] — 2026-07-16 between [Unreleased] and ### Added

Version consistency — all three version strings agree on 0.5.0. No drift between package.json and either field in package-lock.json.

CHANGELOG structure — the [Unreleased] heading is preserved (empty, ready for future work) above the new ## [0.5.0] — 2026-07-16 entry. The existing ### Added content correctly falls under the [0.5.0] section. Date (2026-07-16) matches the PR merge date.

Stray changes — none. The diff contains nothing beyond the three mechanical edits described above.

Semver correctness — 0.4.1 → 0.5.0 is a minor bump. The PR description explains the rationale (new user-facing incidents/ surface, meaningfully stronger detector, no breaking API change). That's consistent with semver minor semantics.

---

What's good

Tight, zero-noise release bump — exactly what a release PR should be. The [Unreleased] sentinel is kept, making the next release cycle easy to start.

No findings. Ready to merge.