chore(main): release 4.28.0

[mvanhorn]

🤖 I have created a release beep boop

4.28.0 (2026-07-06)

Features

• cli: add x-pp-example extension to override endpoint help examples (#3380) (2b45036)
• generator: composite-aware ReconcilePartition seen-set + cascade (#3376) (8d0983b)

Bug Fixes

• clamp sync page size to pagination param's declared maximum (#3441) (1df157c), closes #3440
• cli: calibrate GraphQL generator checks (#3413) (8601d16)
• cli: gate partial failure helpers by emitted callers (#3470) (f5a4795)
• cli: harden publish artifact staging (#3414) (4a2b023)
• cli: honor plan-mode dry runs (#3410) (93c3442)
• cli: implement PKCE for secretless OAuth authorization-code login (#3460) (6e43fd5)
• cli: keep local datastore MCP off HTTP endpoints (#3411) (d9a82a9)
• cli: order path-param positionals by URL path, not declaration order (#3390) (a64d829), closes #3369
• cli: remove vendor-specific profile wording (#3430) (ea8d6fb)
• cli: route browser cookie auth through jar path (#3408) (d30d066)
• cli: skip soft lookup error probes (#3468) (6037ad2)
• skills: block proposal PR fallback for real artifact work (#3412) (95636bf)
• skills: preflight Go currency and disk space (#3409) (ff9e58e)

---

This PR was generated with Release Please. See documentation.

[mergify]

Merge Protections

🔴 1 of 2 protections blocking · waiting on 🙋 you

	Protection	Waiting on
🔴	🚦 Auto-queue	🙋 you
🟢	require-ready-label-and-ci	—

🔴 🚦 Auto-queue

Waiting for

• label = ready-to-merge

This rule is failing.

When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.

• label = ready-to-merge

---

Show 1 satisfied protection

🟢 require-ready-label-and-ci

• #changes-requested-reviews-by = 0
• #review-threads-unresolved = 0
• check-success = build-and-test
• check-success = generated-test
• check-success = go-lint
• check-success = golden
• check-success = pr-title
• check-success = test
• any of:
  • all of:
    • head = release-please--branches--main
    • title ~= ^chore\(main\): release
  • label = ready-to-merge
• any of:
  • -files ~= ^(\.github/workflows/|\.github/scripts/|scripts/|\.github/CODEOWNERS$)
  • author = mvanhorn
  • approved-reviews-by = mvanhorn
  • approved-reviews-by = tmchow
  • author = tmchow
• any of:
  • all of:
    • head = release-please--branches--main
    • title ~= ^chore\(main\): release
  • check-neutral = Greptile Review
  • check-skipped = Greptile Review
  • check-success = Greptile Review
  • head ~= ^mergify/merge-queue/
  • label = queued

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request