feat(engine)!: the inbox is a priority, not a suggestion

Through 0.4.0 the injection block told every repo to "consider
replying/resolving where it fits in this session". That sentence was the
whole problem: the injection text is the only place a repo is ever told
what to do with a message, so the wording IS the protocol -- and it
granted permission to defer. Messages sat unanswered for weeks while each
session did its own work first. Nothing was broken; the protocol was
asking for exactly what it got.

The block now states an ordering and a completion obligation: handle the
inbox before the task the session came to do, and drive every directed
message to a terminal state before the session ends (--reply-to or
coord-done). Neither terminal state is the default -- the format has no
reply-expected field, so mandating only the reply would manufacture
traffic for messages that merely inform. Leaving one pending stays
allowed but must be stated to the operator with a reason.

Raising priority deliberately does not widen the trust boundary. The
obligation is procedural, never substantive: responding is mandatory,
complying with what a message asks is not. Untrusted cross-repo content
still cannot direct the reader; it merely can no longer be ignored. The
injection states both halves and selftest section 20 pins them together,
so a future reword cannot keep the priority and quietly drop the
distinction -- that combination would turn prioritization into an
injection surface.

Selftest 82 -> 93.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U6EixQo6hpoRCVtiAXdnFs

CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0] - 2026-07-25
+
+### Changed
+
+- **The inbox is a priority, not a suggestion (Rule 7).** Through 0.4.0 the
+  injection block told every repo to "consider replying/resolving where it fits
+  in this session". That sentence was the whole problem: the injection text is
+  the only place a repo is ever told what to do with a message, so the wording
+  *is* the protocol — and it granted permission to defer. Messages sat
+  unanswered for weeks while each session did its own work first. Nothing was
+  broken; the protocol was asking for exactly what it got.
+
+  The block now states an ordering and a completion obligation:
+
+  - **Handle the inbox first**, before the task the session came to do — "not
+    after it, not *if there is time*".
+  - **Every directed message must reach a terminal state before the session
+    ends:** `coord-send --reply-to` or `coord-done`.
+  - **Neither terminal state is the default.** The format has no
+    reply-expected field, so mandating only the reply would manufacture
+    traffic for messages that merely inform.
+  - **Leaving one pending stays allowed, but must be stated** to the operator
+    with a reason. The escape hatch is explicit rather than silent.
+
+- **Raising priority deliberately does not widen the trust boundary.** The
+  obligation is procedural, never substantive: *responding* is mandatory,
+  *complying* with what a message asks is not — only the operator authorizes
+  that. Untrusted cross-repo content still cannot direct the reader; it merely
+  can no longer be ignored. The injection states both halves, and the selftest
+  pins them together so a future reword cannot keep the priority and quietly
+  drop the distinction.
+
+- Selftest grew from 82 to 93 checks (new section 20 pins the wording contract:
+  the permissive phrasing is gone, ordering and completion are stated, both
+  terminal states are named with neither as default, responding-vs-complying is
+  kept distinct, and the untrusted-data framing survives).
+
 ## [0.4.0] - 2026-07-25
 
 ### Added