fix(wiki): fix .cjs extension in domain names and double-dot in session tip path; bump to v1.6.3

fix(routes): resolve sub-router mount prefixes before deduplication

feat(wiki): harden accuracy — confidence badges, source file list, coverage gaps, missing file detection

chore: add navigation-aid disclaimers to all wiki articles

docs: show compound token reduction from --wiki (two-layer savings)

docs: anonymize project names in benchmarks

fix: domain detection false positive + real benchmark data

feat: add --wiki knowledge base (v1.6.0)

docs: clarify multi-language support upfront in README

fix: Windows path separators, MCP race condition, PHP detection (v1.5.3)

fix: replace mermaid diagrams with static images for reliable rendering

feat: improve watch mode — extension filtering, config preservation, change reporting (v1.5.2)

fix: worktree name resolution + deterministic token stats

Merge pull request #1 from nealrauhauser/fix/command-injection-open

fix: replace exec() with execFile() to prevent command injection in --open