Merge pull request #4012 from docker/fix/harness-delegation-empty-prompt

fix(runtime): scope harness prompt-selection to fresh vs resume session

Merge pull request #4000 from docker/serve-hardening

feat: harden served-agent safety controls

Merge pull request #3992 from docker/chore/update-models-snapshot

chore: refresh embedded models.dev snapshot

Merge pull request #3963 from docker/large-input-and-413-docs

docs: clarify request-size limits and large input strategies

Merge pull request #3924 from dvdksn/docs/clarify-sbx-sandbox-mode

docs: clarify sbx sandbox integration

Merge pull request #3831 from Piyush0049/fix/security-and-linting-upd…

…ates

fix: agent security and linting improvements

Merge pull request #3899 from pkimtani/feat/interrupt-confirmation

feat(tui): configurable interrupt confirmation for Esc key

Merge pull request #3890 from trungutt/log-empty-desktop-token

desktop: log and recover empty or failed token fetches

Merge pull request #3867 from trungutt/log-expired-desktop-token

feat(desktop): log when Docker Desktop serves an expired token

Merge pull request #3859 from trungutt/log-token-staleness

feat(desktop): log token staleness when refresh recovery fails