chore(main): release 0.30.0

[github-actions]

🤖 I have created a release beep boop

0.30.0 (2026-05-18)

Features

• cli: add ado-aw enable (#583) (1b4273b)
• cli: consolidate Phase 1 pipeline-lifecycle commands (disable/remove/list/status/run/secrets) (#602) (096b7a4)
• compile: add --force flag to bypass GitHub-remote guard (#577) (562ff7f)
• compile: replace Python gate evaluator with bundled TypeScript gate.js (#389) (a2ce38c)
• engine: split copilot CLI install path by compile target (#584) (4fe2175)
• safeoutputs: add daily smoke suite and reject unknown safe-output keys (#563) (29b221e)
• workflows: add clippy-fixer agentic workflow (#575) (ca914f1)
• workflows: allow update-awf-version to close superseded PRs (#590) (e0ddc2c)
• workflows: file release-notes action-item issues from update-awf-version (#593) (d4fedd5)

Bug Fixes

• compile: default non-1es vmImage to ubuntu-22.04 (#578) (b841998)
• compile: enforce ADO build-number rules for pipeline_agent_name (#576) (1c7c407)
• compile: quote pipeline name in generated YAML to handle colons and quotes (#568) (ebd2f17)
• compile: tighten ADO org name validation to alphanumeric and hyphen only (#598) (91d39a9)
• configure: accept bare org name for --org (#579) (8029980)
• safeoutputs: prevent symlink exfiltration in create-pr Stage 3 (#549) (f04c033)
• secrets: preserve masked ADO secrets on definition PUT (#604) (2e0a0bb)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v0.30.0

🌻