[ioquatix]

Raise the private bake/ package's base-project requirement to the 0.1.7 the lockfile already selects and lock its current task providers, including bake-license 0.2.8, whose release hook no longer removes the blank line after module documentation or adds license headers to generated files, and bake-cargo 0.9.1, whose regenerated publish.yml pins the Bake launcher, checks out without persisting credentials and records why actions are pinned to tags; add bake-test 0.3.6's canonical minimum-rust job, which checks the crate with its declared Rust 1.85, to the test-result aggregate; describe the cargo:release:* tasks that replaced cargo:version:* in the readme; and add the standard security guidance to agents.md.