release: v4.19.0

[cdeust]

What

Bumps all 16 version surfaces (scripts/check_version_surfaces.py, 12 files) from 4.18.0 to 4.19.0 and dates the [Unreleased] CHANGELOG section as [4.19.0] - 2026-09-03. No source change.

Contents since v4.18.0

• fix(sqlite): isolate transactions per request (HC-CORTEX-002) #452 SQLite requests no longer share transaction ownership across concurrent MCP workers (HC-CORTEX-002)
• feat(registry): make the repository scan clean for the HOL Plugin Registry #454 HOL plugin scanner workflow, registry-complete Codex package, package-lock.json as a version surface, test-role password literal replaced
• Dependabot: build: bump python from a7fb1e6 to ce40764 in /.devcontainer #432, deps: bump hatchling from 1.31.0 to 1.32.0 #433, deps: bump huggingface-hub from 1.25.1 to 1.27.0 #434, deps: bump ruff from 0.16.0 to 0.16.2 #435, deps: bump pymupdf from 1.28.0 to 1.28.2 #437, deps: bump setuptools from 83.0.0 to 84.0.0 #438, ci: bump astral-sh/setup-uv from 9.0.0 to 10.0.1 #439, ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 #441, build: bump python from 23c5939 to 416f0db in /docker #450, ci: bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.9 #451; rank badge refresh chore: refresh MCP Toplist rank badge #453

Local checks at this commit

python3 scripts/check_version_surfaces.py   -> version surfaces OK (16 site(s) checked)
python3 scripts/check_doc_claims.py         -> doc claims OK
uv lock --check                             -> Resolved 168 packages
python3 scripts/check_marketplace_pins.py   -> PIN_VERSION_UNPUBLISHED (exit 1)

The last one is the expected pre-tag state: the marketplace pins 4.19.0 while the latest tag is still v4.18.0. The marketplace-pins CI job is green on this PR anyway (job 100447111918): its checkout is shallow, fetches no tags, and scripts/marketplace_pins_self.py::check_self_pin returns early when it sees no tags, so the self-pin check is a no-op in CI. Pre-existing and untouched by this diff; issue candidate (add fetch-depth: 0 or fetch-tags: true to that workflow's checkout).

Review

Fresh-context code review on 4e9b2e0: APPROVE. All 16 SURFACES entries mapped to diff hunks, CHANGELOG content matched against the 13 commits since v4.18.0, minor bump consistent with house precedent (### Added content), uv lock --check and check_version_surfaces.py reproduced on the PR head.

After merge

ci.yml's release-gate job runs on the push to main, finds no v4.19.0 tag, re-checks the version surfaces and pushes the annotated tag with the deploy key when RELEASE_TAG_SSH_KEY is configured (otherwise it skips loudly and the tag is set by hand). The tag starts release.yml (GitHub release, PyPI, .mcpb, MCP registry). Then python3 scripts/check_marketplace_pins.py must exit 0.

🤖 Generated with Claude Code

[cdeust]

ZETETIC-REVIEW: APPROVE

Fresh-context review of head 4e9b2e0 (2026-09-03). All 16 SURFACES entries mapped to diff hunks; CHANGELOG content matched against the 13 commits since v4.18.0; minor bump consistent with house precedent (### Added content); uv lock --check and scripts/check_version_surfaces.py reproduced on the PR head. Branch protection is strict=false with 0 required reviews, so no rebase is needed after #455 lands.