main gained the workflow analysis change, which adds a line to the
checkout step right above the action whose version comment this branch
corrects. Both changes are kept: the checkout does not persist its
credentials, and the comment names v4.9.0.

The action is pinned to the commit of v4.9.0, and the comment beside
the pin said v4. Renovate reads the comment as the version in use and
looked for a tag named v5 to update to; the action has v5.0.0 and no
v5, so the lookup failed and Renovate warned about it. The comment now
names the version the commit is.

zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 6 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.

OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly, publishes its score and uploads its findings to
code scanning.

Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.

Adopt Patent Grant 1.1, make the apex host canonical while excluding account surfaces from indexing, move the Progmasoft mail boundary into its owning repository, migrate the .NET 10 tests to native MTP, and add persistent light/dark and en-US/de-DE preferences across corporate and account experiences.