MatrixCtrl 0.1.33

Added

• Release notes for the version you are about to install, shown on the upgrade
  page beside the button that starts it. Not decoration: 26.8.0's notes say "Upgrade
  Element Web to v1.12.25" and "Upgrade Synapse to v1.158.0" — exactly the upgrades
  the pinned image tags were silently preventing. The screen now says both what the
  version brings and, from the pin warning, what a pin will stop it bringing.
• "Upgrade auf X" arrives with X selected. The version travels from the list as a
  search parameter instead of being picked twice.
• Notes are cached per version and the cache is bounded — published notes do not
  change, and GitHub's unauthenticated limit is 60 requests an hour.
• "Could not be fetched" and "no notes published" are different messages, because
  they lead to different conclusions.

Security

• The version becomes a URL path segment and is validated against a strict pattern,
  refused rather than escaped.
• Rendered markdown links only follow http(s). A javascript: URL in third-party
  text must not become clickable in an admin panel.

Fixed

• The documented local deploy shipped the wrong image. The chart's committed
  default is image.tag: "latest" — CI rewrites it to the exact version only when it
  packages a released chart — so a deploy from the working tree rendered :latest
  and ran whatever stale build containerd held. The first attempt at this release
  deployed 0.1.32 while helm list said APP VERSION 0.1.33 and rollout status
  said success. PROZESS §4 now passes
  --set image.tag and ends the read-back with the container's own startup line,
  which reads the artefact rather than a declaration about it.