v0.3.7

What's Changed

• feat(storage): add durable workspace backends and exact managed purge by @amit231self in #40
• fix(metering): record reads when response bodies drop by @amit231self in #41
• fix(security): restrict global admin routes by @amit231self in #42
• fix(security): harden object response headers by @amit231self in #43
• fix(security): authenticate public key mutation by @amit231self in #44
• fix(security): add bounded stateless demo processing by @amit231self in #45
• fix(security): remove stateful demo routes by @amit231self in #46
• fix(security): fail closed on tenant storage resolution by @amit231self in #47
• fix(security): bind semantic headers into SigV4 by @amit231self in #48
• fix(security): validate credential mutation inputs by @amit231self in #49
• fix(security): propagate credential repository failures by @amit231self in #50
• feat(formats): establish format registry foundation by @amit231self in #51
• feat(formats): add bounded schema and value IR by @amit231self in #52
• feat(formats): add native binary reductor contract by @amit231self in #53
• feat(formats): define binary reductor WIT contract by @amit231self in #55
• feat(gateway): add durable usage receipt contract by @amit231self in #54
• feat(runtime): add bounded Wasm binary reductor adapter by @amit231self in #56
• fix(gateway): close launch billing gaps by @amit231self in #57
• feat(gateway): persist durable usage evidence at direct write commit by @amit231self in #58
• feat(gateway): add opt-in Avro OCF processing by @amit231self in #59
• docs: publish Avro support status by @amit231self in #60
• feat(mcp): publish verified stdio object server by @amit231self in #61

Full Changelog: v0.3.6...v0.3.7