desktop-v1.28.0

## What's Changed
* fix(desktop): relaunch agents on the host when the default account switches by @Kitenite in https://github.com/superset-sh/superset/pull/7253
* chore(desktop): bump version to 1.27.0 by @Kitenite in https://github.com/superset-sh/superset/pull/7261
* feat(desktop): open the PR summary as a workspace pane from the Changes pane by @Kitenite in https://github.com/superset-sh/superset/pull/7244
* feat(marketing): add a Content-Security-Policy header to superset.sh by @Kitenite in https://github.com/superset-sh/superset/pull/7265
* fix(marketing): resolve search indexing and localized rendering issues by @Kitenite in https://github.com/superset-sh/superset/pull/7268
* fix(desktop): preserve cursor position in terminal rich input by @Kitenite in https://github.com/superset-sh/superset/pull/7271
* fix(sentry): turn tracing off everywhere and stop reporting updater transport errors by @saddlepaddle in https://github.com/superset-sh/superset/pull/7273
* fix(desktop): keep workspace picker searches open by @Kitenite in https://github.com/superset-sh/superset/pull/7272
* fix(desktop): classify intentional git worker aborts as non-500s by @saddlepaddle in https://github.com/superset-sh/superset/pull/7277
* fix(host-service): classify a hollow nested-repository .git and a broken Xcode git shim as environmental by @saddlepaddle in https://github.com/superset-sh/superset/pull/7278
* fix(host-service): bound transcript line reads so one corrupt file cannot kill the usage worker by @saddlepaddle in https://github.com/superset-sh/superset/pull/7279
* fix(desktop): close a browser pane whose page closes itself and search unparseable addresses by @saddlepaddle in https://github.com/superset-sh/superset/pull/7282
* fix(host-service): stop the login-shell env probe from leaking pipe descriptors by @saddlepaddle in https://github.com/superset-sh/superset/pull/7280
* fix(desktop): classify authorization, launchd, cache-path, 5xx and staging updater failures as environmental by @saddlepaddle in https://github.com/superset-sh/superset/pull/7283
* fix(desktop): refetch Changes pane patches when git state changes by @saddlepaddle in https://github.com/superset-sh/superset/pull/7285
* fix(desktop): cancel timed-out git tasks in the worker instead of terminating the thread by @saddlepaddle in https://github.com/superset-sh/superset/pull/7286
* fix(marketing): stop the API limiter and stale data-cache shapes from 500ing profile pages by @saddlepaddle in https://github.com/superset-sh/superset/pull/7281
* fix(marketing): don't let a refused profile read get cached by @saddlepaddle in https://github.com/superset-sh/superset/pull/7287
* fix(desktop): decide a missing path ourselves before opening it externally by @saddlepaddle in https://github.com/superset-sh/superset/pull/7288
* revert(marketing): back out the unverified profile cache opt-out by @saddlepaddle in https://github.com/superset-sh/superset/pull/7290
* fix(desktop): report why a terminal PTY exited before it was ready by @saddlepaddle in https://github.com/superset-sh/superset/pull/7284
* fix(desktop): apply local-db migrations by identity, not by timestamp watermark by @saddlepaddle in https://github.com/superset-sh/superset/pull/7291
* fix(desktop): key the onboarding gate on the rendered route, not the pending one by @saddlepaddle in https://github.com/superset-sh/superset/pull/7293
* fix(marketing): stop routing one-character paths to the profile page by @saddlepaddle in https://github.com/superset-sh/superset/pull/7295
* fix(desktop): wait for the terminal daemon on the right signal, and say what went wrong by @saddlepaddle in https://github.com/superset-sh/superset/pull/7299
* fix(host-service): apply host.db migrations by identity, not by timestamp watermark by @saddlepaddle in https://github.com/superset-sh/superset/pull/7300
* fix(agent-setup): preserve agent identity and enable OpenCode session resume by @Kitenite in https://github.com/superset-sh/superset/pull/7263
* fix(host-service): bound the diff patch, and stop depending on the launch directory by @saddlepaddle in https://github.com/superset-sh/superset/pull/7303
* fix(api): acknowledge Linear webhooks before fanning them out by @saddlepaddle in https://github.com/superset-sh/superset/pull/7289
* fix(desktop): launch host-service through the crash-port-clearing spawn-helper by @saddlepaddle in https://github.com/superset-sh/superset/pull/7306
* fix(api): keep webhook bookkeeping out of the failure path, and select only the host columns dispatch reads by @saddlepaddle in https://github.com/superset-sh/superset/pull/7307
* fix(web): stop the mesh gradient's CSS-variable poll when the canvas unmounts by @saddlepaddle in https://github.com/superset-sh/superset/pull/7308
* fix(desktop): answer a terminal attach that races the session being reaped by @saddlepaddle in https://github.com/superset-sh/superset/pull/7309
* fix(desktop): stop the stale 'Host unreachable' flash and soften the host gate by @Kitenite in https://github.com/superset-sh/superset/pull/7264
* fix(desktop): stop re-entering Squirrel.Mac staging while an update is already staged by @saddlepaddle in https://github.com/superset-sh/superset/pull/7311
* feat(desktop): show host versions and update standalone hosts by @Kitenite in https://github.com/superset-sh/superset/pull/7270
* fix(desktop): keep workspace panes usable while reconnecting by @Kitenite in https://github.com/superset-sh/superset/pull/7314
* fix(desktop): keep account names out of host-service crash tails by @saddlepaddle in https://github.com/superset-sh/superset/pull/7326
* fix(workspace-fs): bound what nested-repo scans hold while watchers attach by @saddlepaddle in https://github.com/superset-sh/superset/pull/7327
* chore(host-service): log worker results big enough to abort serialization by @saddlepaddle in https://github.com/superset-sh/superset/pull/7328
* fix(desktop): stop a disposed xterm terminal from scheduling render frames by @saddlepaddle in https://github.com/superset-sh/superset/pull/7313
* fix(api): bound the Linear sweep's lock hold and its QStash publishes by @saddlepaddle in https://github.com/superset-sh/superset/pull/7332
* fix(desktop): stop trpc-electron reading a disposed frame on navigation by @saddlepaddle in https://github.com/superset-sh/superset/pull/7335
* feat(skills): add an integrations skill for calling plugin MCP tools by @harshithmullapudi in https://github.com/superset-sh/superset/pull/7242
* feat(marketing): add cloud design partner signup by @Kitenite in https://github.com/superset-sh/superset/pull/7316
* chore: drop the last Electric traces — subprocessor entry and orphaned Caddyfile by @saddlepaddle in https://github.com/superset-sh/superset/pull/7334
* fix(desktop): migrate v1 groups to v2 tags by @Kitenite in https://github.com/superset-sh/superset/pull/7333
* fix(host-service): classify a deliberate worker abort as a non-500 by @saddlepaddle in https://github.com/superset-sh/superset/pull/7329
* fix(api): bound the redispatch sweep's advisory-lock transaction by @saddlepaddle in https://github.com/superset-sh/superset/pull/7330
* fix(host-service): delete worktrees pinned by a read-only directory by @saddlepaddle in https://github.com/superset-sh/superset/pull/7331
* fix(marketing): match cloud page icon to banner by @Kitenite in https://github.com/superset-sh/superset/pull/7344
* feat(desktop): add Pages onboarding and polish creation flows by @Kitenite in https://github.com/superset-sh/superset/pull/7339
* feat(desktop): copy a shareable link to an automation by @saddlepaddle in https://github.com/superset-sh/superset/pull/7347
* fix(desktop): keep a stale diff from crashing the reviewer pane by @saddlepaddle in https://github.com/superset-sh/superset/pull/7348
* feat(mobile): keep switched-to terminals warm with a cached buffer by @saddlepaddle in https://github.com/superset-sh/superset/pull/7346
* fix(mobile): stop leaking iOS internals into error alerts, and retry the blip behind them by @saddlepaddle in https://github.com/superset-sh/superset/pull/7340
* feat(desktop): create a cloud workspace from the sidebar by @saddlepaddle in https://github.com/superset-sh/superset/pull/7352
* feat(pages): split comment mode from the comments panel, theme published pages by @harshithmullapudi in https://github.com/superset-sh/superset/pull/7312
* refactor(desktop): remove the v2 new-workspace modal by @saddlepaddle in https://github.com/superset-sh/superset/pull/7353
* fix(desktop): stop partial module mocks leaking across test files by @saddlepaddle in https://github.com/superset-sh/superset/pull/7337
* feat(mobile): remember the last session tab per workspace by @saddlepaddle in https://github.com/superset-sh/superset/pull/7342
* fix(automations): name the organization instead of a dead-end 404 by @saddlepaddle in https://github.com/superset-sh/superset/pull/7355
* feat(billing): close the paywall funnel through Stripe payment outcomes by @saddlepaddle in https://github.com/superset-sh/superset/pull/7338
* feat(mobile): agent status on the Lock Screen and Dynamic Island by @saddlepaddle in https://github.com/superset-sh/superset/pull/7356
* fix(terminal): drop clients that stop answering so the PTY size unwedges by @saddlepaddle in https://github.com/superset-sh/superset/pull/7358


**Full Changelog**: https://github.com/superset-sh/superset/compare/desktop-v1.27.0...desktop-v1.28.0