[sionsmith]

Bumps teams-cli to 0.11.0. Merging this lets auto-tag.yml tag v0.11.0 and run release.yml.

What's in it

• Browser login (Configurable redirect URI and free loopback port for browser login #125): --redirect-uri / TEAMS_CLI_REDIRECT_URI / profile redirect_uri. The default is now http://localhost/callback on a free port, listening on both 127.0.0.1 and ::1. The callback is served until it arrives, and identity platform errors are reported.
• teams listen (Make teams listen safe behind a relay #119): binds 127.0.0.1 by default (--bind 0.0.0.0 for the old behaviour). Adds --client-state / TEAMS_CLI_CLIENT_STATE filtering; 202 once queued, 503 when full; 1 MiB / 10 s limits; /lifecycle; graceful drain on Ctrl+C. subscribe create --lifecycle-url.
• Agent skills (Add agent skills for the teams CLI #126) under skills/, with a test that keeps them in sync with the CLI.
• subscribe list (Stop sending $top to /subscriptions #131): no longer sends $top, which Graph rejects with HTTP 400. Broken since v0.1.0; found by this release smoke.
• Dependencies (deps: bump sha2 from 0.10.9 to 0.11.1 #124, ci: bump Swatinem/rust-cache from 2.9.2 to 2.9.3 in the github-actions group #127, deps: bump the rust-minor group across 1 directory with 4 updates #128): RUSTSEC-2026-0381/0382/0386 cleared; rust-version corrected to 1.89.

See CHANGELOG.md for the full list.

Release gate (local, macOS)

• cargo fmt -- --check, cargo check, cargo clippy -D warnings, and cargo test --all-targets --all-features (401 unit + 113 CLI + 11 listen) all pass.
• cargo build --release --locked passes, and cargo audit is clean.
• mandoc -Tlint passes on all five man pages, whose .TH headers are bumped to 0.11.0 / October 27, 2026. git diff --check is clean.
• ./target/release/teams --version prints only teams 0.11.0, and config path reports namespace teams-cli.

Live smoke (release binary, 2026-10-27)

• Browser login through the new default (http://localhost/callback, free port 57433, bound on 127.0.0.1 and ::1) against real Entra: signed in as Sion@oso.sh.
• Graph calls: auth status, auth doctor (redirect_uri reported), user me, team list, chat list (has_more: true + next_link), presence get, and subscribe list (+ --all-pages) all succeed. The pre-Stop sending $top to /subscriptions #131 binary got a 400 on subscribe list.
• listen: binds only 127.0.0.1; /lifecycle validation echoes the token; a forged clientState is dropped (202, not printed); a genuine notification is printed with kind and without clientState; Ctrl+C exits 0.
• Not run: a message send round trip. The signed-in account is not in the sandbox chat, and send paths are unchanged in this release.

🤖 Generated with Claude Code