v0.8.1

What's Changed

• chore(helm): bump chart appVersion to v0.7.1 by @github-actions[bot] in #239
• chore(deps): go 1.26.3 + golang.org/x/net v0.53.0 (CVE bumps) by @pschleger in #241
• docs: correct stale isolation-level references to SI+FCW by @pschleger in #240
• docs: README + OVERVIEW→FEATURES + new help topics (admin, cluster) — evaluator-first refactor by @pschleger in #242
• feat(helm): optional separate migration DSN (migrate.postgres) by @pschleger in #268
• chore(deps): bump the minor-and-patch group across 1 directory with 8 updates by @dependabot[bot] in #267
• chore(deps): bump distroless/static from 47b2d72 to 3592aa8 in /deploy/docker by @dependabot[bot] in #248
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #245
• chore(deps): bump busybox from 1.37 to 1.38 in /deploy/docker in the minor-and-patch group by @dependabot[bot] in #266
• ci: run full CI battery on release/** branches by @pschleger in #269
• refactor(workflow): #250 split processor execution-location from scheduled-transition timing by @pschleger in #265
• chore(deps): target Dependabot PRs at release/v0.8.0 by @pschleger in #275
• chore(deps): bump go directive to 1.26.4 — stdlib CVE fixes by @pschleger in #279
• feat(iam): OpenAPI conformance for /oauth/keys/* (keypair + trusted) — closes #281 by @pschleger in #289
• feat(spi): tx-state sentinel errors — closes #200 by @pschleger in #294
• feat(grpc): wire ProcessorConfig.Context pass-through for Cloud parity (closes #253) by @pschleger in #297
• feat(workflow): tighten import-time validation (state graph, names, ExecutionMode enum) — closes #255 by @pschleger in #298
• feat(entity): grouped statistics query endpoint (closes #299) by @pschleger in #300
• feat(workflow): silent-default semantics — closes #256 by @pschleger in #302
• chore(workflow): import/export boundary hygiene sweep — closes #257 by @pschleger in #306
• test(workflow): import/export coverage sweep — closes #258 by @pschleger in #307
• feat(workflow): scheduled-transition configuration shape + SPI by @pschleger in #308
• feat(workflow): asyncResult + crossoverToAsyncMs SPI shape with import rejection — closes #261 by @pschleger in #309
• feat(workflow): RetryPolicy import-time validation + surface inbound retryable flag — closes #262 by @pschleger in #310
• feat(workflow): strict-decoder on import handler — closes #264 by @pschleger in #311
• feat(iam): OpenAPI conformance for /clients (technical users) by @pschleger in #312
• feat(iam): OIDC providers subsystem (#284) by @pschleger in #314
• auth help topic + v0.8.0 OIDC polish by @pschleger in #316
• feat(auth/oidc): #317 support object-shaped rolesClaim (Zitadel) by @pschleger in #318
• chore(help): use sort.Strings, drop hand-rolled insertion sort by @pschleger in #320
• chore(release): forward-port cyoda-platform → cyoda org-rename fix by @pschleger in #324
• feat(workflow): forward-port schema-version contract (#319) + bump 1.0 → 1.1 for v0.8.0 by @pschleger in #327
• chore(deps): bump mikefarah/yq from 4.53.2 to 4.53.3 in the minor-and-patch group across 1 directory by @dependabot[bot] in #325
• feat(workflow): client-owned annotations on workflows, states, and transitions by @pschleger in #329
• feat(observability): wire OIDC subsystem metrics (D22 follow-up to #284) by @pschleger in #331
• fix(test): unbuffered FaultInjectingKV pause channel (fix intermittent race deadlock) by @pschleger in #332
• release-prep v0.8.0: deps sweep, SPI v0.8.0 pin, GOPRIVATE fix, doc finalize by @pschleger in #333
• Release v0.8.0 by @pschleger in #334

Full Changelog: v0.7.1...v0.8.1