Release v16.9.2

Summary

Closes the two gaps left by CHR0038: the fluent join spelling, and what happens when a cross-subject [PII] join reaches runtime anyway.

Added

• ComplianceMetadataActionFailed replaces the bare InvalidOperationException when applying or releasing compliance metadata fails. On a failed release it names the property, the subject the value was released under, and explains that the value was encrypted under a different subject, pointing at CHR0038 — rather than surfacing only the underlying OpenSSL oaep decoding error.

Changed

• CHR0038 now also reports the fluent builder.Join<TEvent>(_ => _.On(...)) form, not just the model-bound [Join<TEvent>] attribute. A [PII] value counts as reaching the read model through an explicit .Set(...).To(...) mapping or through AutoMap matching an identically named property.