release prep: VERSION 1.18.0 and the [1.18.0] changelog (#565)

[VijitSingh97]

Closes #565.

Owner ruling on pithead#2602 (2026-10-02): the next RigForge release is 1.18.0. The pithead 2.0.0 image pins the develop commit that carries it (pithead#3029), and the release is cut after the 2.0.0 soak (rigforge#564). This PR lands the release content now, so the post-soak release is only the promotion and the tag.

Changes

• VERSION: 1.17.4 → 1.18.0.
• CHANGELOG.md: removed the never-released [1.17.4] - 2026-09-08 section. Its Fail closed across the combined appliance release gates #491 entry and every change since v1.17.3 (21 commits) are folded into [1.18.0] - 2026-10-02 under Added / Changed / Deprecated / Fixed, each written from the commit's own message. One correction: the doctor token echo that One access token per consuming stack (ACCESS_TOKENS) (#516) #521 fixed came from One access token per consuming stack (ACCESS_TOKENS) (#516) #521's own new line and never shipped, so it is not listed as a security fix.

No code change. VERSION is read only for the reported version string (rigforge version and the sister API's rigforge.version). The suite derives its expected value from the file (tests/run.sh version and summary assertions, tests/e2e/in-container.sh), so those assertions follow the bump. No path changes behaviour, so no bench tier applies.

Validation

• make lint-md (markdownlint-cli2 0.22.1): 25 files, 0 errors.
• The release workflow's notes extraction (awk on ## [1.18.0]) finds the new section.
• git grep 1.17.4 outside the changelog: only VERSION, now changed.
• Topology check over the diff: clean.

Not a release: no tag, no GitHub release, no promotion to main.

🤖 Generated with Claude Code

[pithead-reviewer]

adversarial-review: PASS at 1130e6a, round 1, by the pithead-reviewer reviewer (a fresh session that did not produce this head; claude-sonnet-5-5).

PR #566 does what issue #565 asks: VERSION goes from 1.17.4 to 1.18.0, the never-released [1.17.4] section is removed, and its #491 entry plus every change since v1.17.3 sits in [1.18.0]. All 21 commits since v1.17.3 are covered, and the entries match the commit messages. The diff touches no code, so no bench tier applies. All eight GitHub checks are green at the head (1130e6a). My local make test could not pass on this Mac, for reasons unrelated to the diff, and I did not run the pre-PR commit for comparison.

Evidence

• git diff HEAD~1 HEAD: only VERSION (1.17.4 to 1.18.0) and CHANGELOG.md change, so no code path and no bench-ci tier applies.
• git log v1.17.3..HEAD~1: 21 commits, matching the PR body's count. I checked each against its changelog entry: perf: record miner-3 v1.17.3 baseline #490, test: fail closed across combined appliance gates (#491) #492, docs: develop merges on green checks plus a recorded adversarial review #496/docs: AI_RULES.md, the shared source for AGENTS.md, CLAUDE.md and .cursorrules #497, test(e2e): drive the apt prerequisite retry loop (#449) #498, test: pin file-budget baseline immutability #500, test: normalize BSD watchdog assertion count #503, Deprecate macOS as a supported platform #504, fix(control): control implies the sister enriched feed (#507) #517, fix(control): always record a terminal outcome for a claimed apply #511, One access token per consuming stack (ACCESS_TOKENS) (#516) #521, fix(control): the upgrade oneshot opts out of the 90s start timeout #524, fix(test): set_cfg dies with exit 2 on a failed apply #522, fix(api): serve the control changes/ ring on the unauthenticated read feed #525, fix(control): control-upgrade shares control-apply's EXIT floor (#535) #536, chore(ci): update stale tool pins before 2.0.0 #543, test: capture timer refresh timings during thermal apply (#546) #547, fix: surface onion SOCKS setup and advisory proxy diagnostics #548, perf(api): avoid per-core processes in refresh (#540) #541, fix: clean up partial refresh profiler overrides #552, fix(tests): hide ordinary control setup token from jq arguments #560. None is missing and none is invented. The The tier4-e2e gate cannot exercise the control-apply path on a rig #512/tier4-e2e worker-api dies silently on any control-enabled rig: set_cfg blanks ACCESS_TOKEN, apply refuses fail-closed #514/Control apply: DONATION remains accepted and never reaches a terminal result #509/One access token per consuming stack, so a bench borrow never needs prod's token #516 references come from those commits' own bodies.
• I read the commit bodies for the entries that make specific claims: the 600s apply timeout, the upgrade oneshot's start-timeout opt-out, the EXIT floor shared by upgrade and apply, control implying the feed with control_port == api_port refused, control_history dropping only a malformed entry, ACCESS_TOKENS semantics, and the profiler-override cleanup. All match.
• The omitted doctor token echo: git show 42df15d says One access token per consuming stack (ACCESS_TOKENS) (#516) #521's own new doctor line echoed ACCESS_TOKEN. git grep on v1.17.3 for that pattern in rigforge.sh and util finds nothing, and its existing doctor line prints the literal 'token'. So it was never a shipped fix, and leaving it out is correct.
• git grep -n 1.17.4 on the worktree: no output, so no stale reference remains. git tag | grep 1.17 shows v1.17.0 through v1.17.3 only, so 1.17.4 was never tagged.
• make lint-md (markdownlint-cli2 0.22.1): 25 files, 0 errors. The awk extraction of ## [1.18.0] from CHANGELOG.md returns 55 lines.
• gh pr view 566 (statusCheckRollup, head 1130e6a): all eight checks SUCCESS: yamllint, gitleaks, markdownlint, zizmor, shellcheck+shfmt, test suite, e2e (Docker), coverage.
• bash tests/run.sh on this Mac (Darwin) at the head: 2289 passed, 17 failed. The 17 are macOS-host build/deploy/upgrade/appliance full-run legs (cmake/make stubs, 'macOS huge-pages off', 'service: unsupported on macOS'). macOS is deprecated per Deprecate macOS as a supported platform #504 and the CI Linux suite is green. No version assertion fails: 'VERSION is SemVer (1.18.0)', 'version prints RigForge + semver' and 'doctor: prints version' all pass. I did not run the pre-PR commit for comparison; the diff touches no code.
• make lint locally fails on shfmt style in tests/run.sh, which this PR does not touch. My local shfmt is 3.13.1 and CI pins 3.14.1 (see chore(ci): update stale tool pins before 2.0.0 #543). CI's shellcheck+shfmt job is green at the head, so this is my environment.
• detect-topology.py over the PR body and comments, issue Set VERSION 1.18.0 and fold the changelog into [1.18.0] before the pithead 2.0.0 pin #565 body and comments, and the PR diff: clean in each case. The PR has no comments and the issue has none.
• I did not run make ci or make coverage, and ran no Docker. Docker-dependent evidence is the PR's own e2e and coverage checks, both green.

Findings

• [note] PR release prep: VERSION 1.18.0 and the [1.18.0] changelog (#565) #566 body, Validation: The body says the suite derives its expected version from VERSION and so follows the bump. That held in my run: the VERSION assertions pass at 1.18.0. Its 'No path changes behaviour, so no bench tier applies' is also right for a VERSION and CHANGELOG diff.
• [note] CHANGELOG.md:10: The heading date 2026-10-02 is provisional; the issue allows it to move at release time. The release then needs only the promotion and the tag.