fix: restore a green suite, and repoint URLs at the overwirehq org

[RichardAtCT]

Description

Follow-up to #222, which merged before these landed. Three things, all of them consequences of the org move and the 1.7.0 release.

main is currently red; this fixes it. test_allowed_tools_none_unaffected_by_approval_filter asserts that allowed_tools is None when DISABLE_TOOL_VALIDATION is set, but 94d764d (#206) changed that value to [] so it matches the list[str] that ClaudeAgentOptions declares. #217 added the test against a base that did not yet carry #206, so neither pull request was red on its own and the failure only appeared once both were on main.

[] is the intended value, not the test: the changelog for #206 records the change as deliberate, and two other tests in the same file (test_sdk_integration.py, around lines 807 and 1433) already assert allowed_tools == [] and disallowed_tools == []. Line 689 was the outlier. The test's intent is sound, so only the expected value changes; the test is renamed because "none" in its name is what made the mismatch easy to miss.

Repository URLs now point at overwirehq. Every github.com/<owner>/claude-code-telegram URL across the README, setup and development docs, SECURITY.md, the three issue templates, CONTRIBUTING.md, the packaging metadata and the star-history badge. GitHub redirects the old URLs, so this is about having one canonical location rather than about anything breaking. References to @RichardAtCT as a person are deliberately left alone: the six CODEOWNERS entries and the maintainers table point at a personal account that has not moved.

The v2 roadmap is rebased on reality. The security fix for #219 shipped as 1.7.0 rather than 1.6.2, so M0 moves from 1.7 to 1.8 rather than claiming a version that is already out. #217 is dropped from the out-of-scope table and from the prerequisites now that it is merged, and the leftover 1.6.2 references from the version rename are corrected. Item 0.4 now names ghcr.io/overwirehq/claude-code-telegram, so the first published image lands there with no legacy path to keep.

The changelog Unreleased entries from #222 are also restored here. The merge that brought 1.7.0 into that branch dropped them during conflict resolution, which left the community files and roadmap shipped with no changelog record.

Related issue

None directly. Repairs the interaction between #206 and #217, and follows up #222.

Type of change

• Bug fix
• New feature
• Breaking change (documented in CHANGELOG under "Changed" or "Removed")
• Documentation or tooling only

How it was tested

• Tests added or updated — the stale expectation is corrected rather than removed; no test is skipped or deleted
• make test and make lint pass locally: 588 passed, 0 failed; black, isort and flake8 clean
• Verified the failure exists on a clean checkout of main before fixing it, so it is not introduced by this branch
• Verified the branch diff against main touches only the 14 files listed above, with no source file and no revert of feat: interactive Telegram approval for risky tool calls #217 or ci: install from the committed lock instead of regenerating it #224
• Tested by hand against a running bot: not applicable, no runtime behaviour changes

Checklist

• One concern per PR; unrelated changes are split out — the test fix rides along because main is red and this is the open branch
• CHANGELOG.md has an entry under [Unreleased]
• Documentation updated (README.md, docs/, SECURITY.md, CONTRIBUTING.md)
• New settings default to current behaviour (none added)
• If AI tools helped write this change, I reviewed every line and the hand-testing above is mine

Still outstanding after this merges

Repository settings a pull request cannot change, carried over from #222:

1. Add the CLAUDE_CODE_OAUTH_TOKEN secret, or switch the review workflow to ANTHROPIC_API_KEY. Until then that workflow fails on its first run.
2. Create the labels listed in MAINTAINERS.md; GitHub silently drops template labels that do not exist.
3. Enable private vulnerability reporting so the Security Advisories link in the issue chooser works.

Worth a separate look: the two pull requests that broke main were each green in isolation. Requiring branches to be up to date with main before merge would have caught it.

🤖 Generated with Claude Code

https://claude.ai/code/session_019LaezV767Pguhpat9zVyEs

---

Generated by Claude Code