v2026.5.4

## What's Changed
* v2026.4.17 by @DonPrus in https://github.com/nullclaw/nullclaw/pull/830
* fix(skills): support Agent Skills RFC 0.2.0 and harden web skill fetch | 修复(skills): 支持 Agent Skills RFC 0.2.0 并强化 Web Skill 拉取流程 by @manelsen in https://github.com/nullclaw/nullclaw/pull/831
* feat: add tool customization config schema | 特性: 添加工具定制化配置模式 by @manelsen in https://github.com/nullclaw/nullclaw/pull/834
* feat(tools): implement system_prompt and enabled overrides | 特性(tools): 实现 system_prompt 和 enabled 覆盖 by @manelsen in https://github.com/nullclaw/nullclaw/pull/835
* feat(agent): trigger-based tool prioritization | 特性(agent): 基于触发词的工具优先级排序 by @manelsen in https://github.com/nullclaw/nullclaw/pull/836
* feat(config): support external tool_customizations_file | 特性(config): 支持外部 tool_customizations_file by @manelsen in https://github.com/nullclaw/nullclaw/pull/837
* feat(matrix): add pantalaimon E2EE proxy support | 特性(matrix): 添加 pantalaimon E2EE 代理支持 by @manelsen in https://github.com/nullclaw/nullclaw/pull/838
* feat(skills): support nested skill discovery in category subdirectories | 特性(skills): 支持在分类子目录中发现技能 by @manelsen in https://github.com/nullclaw/nullclaw/pull/840
* feat(agent): add --skill flag to activate a skill at startup by @manelsen in https://github.com/nullclaw/nullclaw/pull/841
* fix(onboard): clear actionable message when KeyWriteFailed during config save by @manelsen in https://github.com/nullclaw/nullclaw/pull/843
* feat(agent,gateway): add --workspace flag to override workspace directory by @manelsen in https://github.com/nullclaw/nullclaw/pull/842
* feat(a2a): forward skill tool-call progress hints to A2A stream | 特性(a2a): 将技能工具调用进度提示转发至 A2A 流 by @manelsen in https://github.com/nullclaw/nullclaw/pull/844
* feat(memory): Knowledge Graph Memory backend with SQLite recursive CTEs | 特性(memory): 基于 SQLite 递归 CTE 的知识图谱内存后端 by @manelsen in https://github.com/nullclaw/nullclaw/pull/712
* Fix gateway bind and rate limit safeguards by @ScottTPfaff in https://github.com/nullclaw/nullclaw/pull/789
* feat(core): inbound router and mid-turn injection infrastructure | 特性(core): 入站路由器与中途注入基础设施 by @manelsen in https://github.com/nullclaw/nullclaw/pull/845
* feat(channel_loop): route inbound via inbound_router | 特性(channel_loop): 通过 inbound_router 路由入站消息 by @manelsen in https://github.com/nullclaw/nullclaw/pull/846
* feat(gateway): route inbound via inbound_router | 特性(gateway): 通过 inbound_router 路由入站消息 by @manelsen in https://github.com/nullclaw/nullclaw/pull/847
* feat(daemon): route inbound bus messages via inbound_router | 特性(daemon): 通过 inbound_router 路由总线入站消息 by @manelsen in https://github.com/nullclaw/nullclaw/pull/848
* fix(memory): improve archive provenance and recall quality | 修复(memory): 提升归档来源与召回质量 by @manelsen in https://github.com/nullclaw/nullclaw/pull/852
* fix(gateway): add accept-loop backoff to prevent CPU spin | 修复(gateway): 为 accept 循环增加退避，避免 CPU 空转 by @manelsen in https://github.com/nullclaw/nullclaw/pull/853
* fix(subagent): deliver completions to original channel context | 修复(subagent): 将完成结果回传到原始频道上下文 by @manelsen in https://github.com/nullclaw/nullclaw/pull/854
* fix(daemon,session): enable inbound concurrency and turn preemption | 修复(daemon,session): 启用入站并发与轮次抢占 by @manelsen in https://github.com/nullclaw/nullclaw/pull/855
* feat(tunnel): add encrypted tailscale auth_key support | 新增(tunnel): 支持加密的 tailscale auth_key by @manelsen in https://github.com/nullclaw/nullclaw/pull/850
* feat(capabilities): add colored table format for channels with TTY detection by @manelsen in https://github.com/nullclaw/nullclaw/pull/863
* security: add 3-tier risk classification and exec-prefix stripping by @vernonstinebaker in https://github.com/nullclaw/nullclaw/pull/875
* fix(channels/mattermost): finalize allocating writer body before curlPost by @vernonstinebaker in https://github.com/nullclaw/nullclaw/pull/877
* feat(security): wrap web_fetch and web_search output with anti-spoofing boundaries by @mark-os in https://github.com/nullclaw/nullclaw/pull/880
* fix(service): harden SysVinit script for RTC-less hardware by @mark-os in https://github.com/nullclaw/nullclaw/pull/856
* fix(compat/net): use direct posix read/write in Stream by @jmylchreest in https://github.com/nullclaw/nullclaw/pull/858
* Fix/add crit tests by @DonPrus in https://github.com/nullclaw/nullclaw/pull/884

## New Contributors
* @ScottTPfaff made their first contribution in https://github.com/nullclaw/nullclaw/pull/789

**Full Changelog**: https://github.com/nullclaw/nullclaw/compare/v2026.4.17...v2026.5.4