What's Changed

• docs: refresh contributing workflow by @Fhatu12 in #412
• chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #398
• docs: sync contribution templates with module manifest by @Fhatu12 in #415
• fix(release): widen registry propagation window so a shipped publish is not a red release by @heznpc in #413
• docs(security): match trust claims to the scope the code actually enforces by @heznpc in #414
• chore(ci): enforce src formatting so the gate cannot drift silently by @heznpc in #416
• test: cover summarize-audit fixture mode by @Fhatu12 in #417
• docs(template): ask PRs to link the issue with Closes by @heznpc in #419
• test(calendar): add script/outputSchema shape contract and fix three drifts by @heznpc in #420
• docs: lead the README with what the reader can do by @heznpc in #421
• test(notes,reminders,mail,finder): extend script/outputSchema contract, fix list_mailboxes by @heznpc in #422
• test(iWork): add injection-focused generator suites for Pages, Numbers, Keynote by @heznpc in #423
• fix(registry): add the Dockerfile Glama needs, and a CI gate so it cannot break silently by @heznpc in #424
• fix(release): gate the signed app lane on a variable instead of a phantom approval by @heznpc in #425
• fix(release): pin the signing guards to the project's real Developer ID by @heznpc in #426
• fix(docs,doctor): correct five places where docs and doctor disagreed with the code by @heznpc in #427
• docs: close the two release blockers before cutting 2.16.3 by @heznpc in #428
• chore(release): v2.16.3 by @heznpc in #429

Full Changelog: v2.16.2...v2.16.3