v0.44.0

This release adds two OAuth scopes at login, enabling code-level profiling and classic-to-3rd-gen dashboard migration through dtctl exec api and dtctl-* plugins. It also fixes the GCP preview commands skipping the root's global checks.

✨ Highlights

New scopes at dtctl auth login (#698, #699)

No safety level requested these before, so calls needing them got a 403 whatever the IAM policy allowed.

Scope	Unlocks	Requested by
storage:profiles:read (#698)	Code-level profiling data (code-level analysis API, dtctl-* plugins)	readonly, readwrite-all, dangerously-unrestricted
environment-api:dashboard-3rdgen-migration:execute (#699)	Converting a classic dashboard to 3rd gen	every safety level

• The migration endpoint only returns the converted dashboard and saves nothing, so readonly can request it. Storing the result still needs document write scopes.
• All dtctl OAuth clients are registered for both scopes. The IAM policy is still a separate gate.
• Existing sessions need a fresh dtctl auth login. Platform tokens are unaffected.

🐛 Fixes

• GCP preview commands run the root's pre-run checks (#696) — the 17 * gcp * commands skipped --dry-run rejection and --jq normalisation, so get gcp connection --dry-run called the API instead of exiting 2 like get aws connection --dry-run. The Preview notice now prints only after the command line is accepted.

Full Changelog: v0.43.0...v0.44.0