Release v3.8.42 (#5459)

Release v3.8.42 — full CHANGELOG in CHANGELOG.md.

CI: 103 checks green incl. CodeQL (all languages), Semgrep, all 8 unit shards,
coverage, Node 24 compat, and integration tests. Full unit suite validated
locally: 19437 pass / 0 fail. The 3 red checks are advisory and do not gate
main (no required status checks): SonarCloud/SonarQube new-code coverage gate,
and PR Test Policy (test-masking detector flagging the legitimate dead-Phind
provider removal in #5530 — reviewed, correct).

Includes cycle-close reconciliation + repair of inherited base-red tests from
#5480/#5527/#5427/#5521 that the PR->release fast-path did not exercise.

scripts/build/pack-artifact-policy.ts

@@ -47,6 +47,11 @@ export const APP_STAGING_ALLOWED_EXACT_PATHS: string[] = [
   "scripts/dev/tls-options.mjs",
   "server.js",
   "server-ws.mjs",
+  // #5452: dist/tls-options.mjs is copied by assembleStandalone (EXTRA_MODULE_ENTRIES)
+  // and imported by dist/server-ws.mjs for opt-in native HTTPS/TLS (#5361). Without
+  // this bare entry the prepublish prune (Step 10.7) deletes it → `omniroute serve`
+  // crashes with ERR_MODULE_NOT_FOUND (regressed in the published 3.8.41 tarball).
+  "tls-options.mjs",
   "webdav-handler.mjs",
 ];
 
@@ -144,6 +149,9 @@ export const PACK_ARTIFACT_REQUIRED_PATHS: string[] = [
   "dist/responses-ws-proxy.mjs",
   "dist/peer-stamp.mjs",
   "dist/http-method-guard.cjs",
+  // #5452: regression guard — make check:pack-artifact fail loudly if the TLS
+  // opt-in sidecar (imported by dist/server-ws.mjs) ever vanishes from the tarball.
+  "dist/tls-options.mjs",
   "dist/webdav-handler.mjs",
   "bin/cli/program.mjs",
   "bin/mcp-server.mjs",