chore(release): cut orb-v2.1.0

[github-actions]

Proposes cutting orb-v2.1.0 (a minor release) from the current
stable release orb-v2.0.0.

Merging this PR tags orb-v2.1.0 and dispatches the image build/publish --
which still requires a release environment approval before anything reaches GHCR (see
.github/workflows/release-selfhost.yml). The daily beta channel is unaffected either way.

Image-relevant commits since the last stable release

• feat(gate): configurable advisory check-runs so a stuck external status never freezes the gate (feat(gate): configurable advisory check-runs so a non-resolving external status never blocks or stalls the gate forever #4372) (3175d74)
• test(gate): pin the advisory-hold cache-invalidation guarantee end-to-end (feat(gate): configurable advisory check-runs so a non-resolving external status never blocks or stalls the gate forever #4372) (1b33341)
• feat(review): add OpenAI and Anthropic API key patterns to secret scan (6a8cc67)
• fix(rebrand): rename gittensory-repo-focus-manifest.ts module (6b5b020)
• feat(mcp): expose skipped-PR audit trail as a maintainer MCP tool (6e059b0)
• feat(mcp): expose repo registration readiness as a read-only MCP tool (f7266c4)
• fix(review): treat a blank consentPhrase as unset in evaluateClaCheck (fix(review): evaluateClaCheck treats an empty-string consentPhrase as unconditionally satisfied #5838) (0a10fcb)
• fix(review): sanitize control characters in RAG chunk text before Postgres insert (2afe341)
• fix(selfhost): preserve stack traces and split fingerprints for RAG/enrichment Sentry captures (02ed1ff)
• fix(review): scan added lines whose content starts with ++ for secrets (fix(review): stale +++ file-header guard in scanDiffForSecretsWithLocations bypasses secret scanning on added lines starting with ++ #5942) (fix(review): scan added lines whose content starts with ++ for secrets #5952) (fe331a9)
• fix(signals): filter public-unsafe wantedPaths/preferredLabels from manifest findings (fix(signals): filter public-unsafe wantedPaths/preferredLabels from manifest findings #5967) (4076df1)
• fix(queue): scan patch-less copied/changed/unchanged files for secrets (fix(queue): shouldAttemptPatchLessSecretScan silently skips copied/changed/unchanged file statuses, bypassing the fail-closed secret scan guarantee #5947) (fix(queue): scan patch-less copied/changed/unchanged files for secret scan #5951) (49883fa)
• feat(selfhost): warn loudly when the private config mount is empty (6b97ffe)
• fix(review): apply the prompt-injection reputation override before the minSample guard (fix(review): apply the prompt-injection reputation override before the minSample guard #5975) (ac83483)
• fix(review): hash a JSON payload in linkedIssueSatisfactionCacheInputFingerprint (fix(review): hash a JSON payload to prevent linked-issue-satisfaction cache-key collisions #5976) (68fac24)
• fix(selfhost): give structural AI-provider config errors a long circuit-breaker cooldown (c5940b7)
• fix(selfhost): instrument the silent orb-relay-drain reentrancy skip (dd4addb)
• fix(signals): filter wantedPaths before interpolating focus-area PR guidance (fix(signals): filter wantedPaths before interpolating focus-area PR guidance #5987) (46581d7)
• fix(review): fold repo into ops_anomaly's Sentry fingerprint (def4205)
• fix(signals): make blockers explain every not-ready registration report (fix(signals): buildRegistrationReadiness can return ready:false with an empty blockers array #5946) (55cd8da)
• fix(selfhost): attach a pg.Pool error listener to prevent uncaught-exception crashes (592fdc8)
• fix(review): make size-gate file/line thresholds configurable (df54527)
• feat(review): wire the copycat containment engine into the gate (feat(review): wire the copycat containment engine into the gate #5999) (9c5a6e0)
• fix(review): give LOOPOVER_DUPLICATE_WINNER a per-repo config override (39cdc9f)
• fix(queue): log unrecognized job types in processJob instead of dropping silently (fix(queue): processJob silently drops unrecognized job types with no default case or logging #5836) (42853bd)
• fix(signals): flag the .at(-1)/.at(0) idiom in boundary-test-generation (fix(signals): flag the .at(-1)/.at(0) idiom in boundary-test-generation #6006) (3db64d8)
• fix(orb): close 5 silent-failure and missing-timeout gaps in the ORB subsystem (b490199)
• fix(orb): use String(error) instead of an untested instanceof-Error ternary (de97a73)
• fix(review): add missing duplicationDelta to REES_ANALYZER_NAMES (fix(review): add missing duplicationDelta to REES_ANALYZER_NAMES #6009) (f4e327a)
• feat(mcp): expose .loopover.yml config recommendations as a read-only MCP tool (feat(mcp): expose .loopover.yml config recommendations as a read-only MCP tool #6016) (3912e7d)
• fix(review): give LOOPOVER_OPEN_PR_FILE_COLLISION a per-repo config override (d3bf13b)
• fix(review): honor ContentRepoSpec.urlFields in directory-index synthesis (fix(review): honor ContentRepoSpec.urlFields in directory-index synthesis #6018) (018b713)
• fix(signals): carry labelPolicy.note through focusManifestPolicyToCompilerOutput (fix(signals): carry labelPolicy.note through focusManifestPolicyToCompilerOutput #6020) (79bfa91)
• feat(orb): wire Sentry into the Cloudflare Worker (central ORB broker) (f8d4a16)
• fix(orb): v8-ignore the Worker-runtime-only Sentry middleware branch (9597167)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.