v0.5.64

What's Changed

• fix(auth): bind trusted-proxy identity passport on human-decision routes by @CueCrux-Myles in #738
• fix(custody): pin the signed-export identity, refuse ephemeral signers (play03 D2 / M2) by @CueCrux-Myles in #735
• fix(work): the ExecPlan projection is workspace-scoped, not tenant-scoped by @CueCrux-Myles in #743
• fix(index): a truncated posting list must not hang every query by @CueCrux-Myles in #744
• chore(release): v0.5.64 by @CueCrux-Myles in #746
• security: isolate JWT fact-backed tenants (red-steel S3c) by @CueCrux-Myles in #745

Full Changelog: v0.5.63...v0.5.64