v0.9.1

What's Changed

🛠️ Maintenance

• chore(deps): bump peter-evans/create-pull-request from 7 to 8 by @dependabot[bot] in #676
• chore(deps): bump assert_cmd from 2.2.0 to 2.2.2 by @dependabot[bot] in #681
• chore(deps): bump spin from 0.10.0 to 0.11.0 by @dependabot[bot] in #680
• chore(deps): bump rcgen from 0.14.7 to 0.14.8 by @dependabot[bot] in #679
• chore(deps): bump jsonwebtoken from 10.3.0 to 10.4.0 by @dependabot[bot] in #678
• chore(deps): bump aws-lc-rs from 1.16.3 to 1.17.0 by @dependabot[bot] in #677

Other Changes

• release(v0.9.0): post-release audit record by @EffortlessSteven in #674
• feat: generate stable RIPR PR summaries by @EffortlessSteven in #675
• ops: start first-run UX lane by @EffortlessSteven in #682
• docs: add start-here task router by @EffortlessSteven in #683
• docs: make contract packs visible by @EffortlessSteven in #684
• feat(cli): add profile discovery commands by @EffortlessSteven in #685
• docs(spec): define CLI proof handoff boundary by @EffortlessSteven in #687
• xtask: add local proof doctor by @EffortlessSteven in #688
• docs: compress README first-run path by @EffortlessSteven in #689
• xtask: add user-path smoke checks by @EffortlessSteven in #690
• docs: close out first-run UX lane by @EffortlessSteven in #692
• feat(cli): explain bundle profiles in place by @EffortlessSteven in #693
• test(ssh): cover host certs, accessors, debug redaction, and stable_bytes deltas by @EffortlessSteven in #695
• test(webhook): cover all profiles for near-miss, raw payloads, hmac key boundaries by @EffortlessSteven in #696
• test(webauthn): cover assertion fields, self-attestation, label/challenge uniqueness by @EffortlessSteven in #697
• test(entropy): cover variant constructor, zero-len, length-distinct caches, clone by @EffortlessSteven in #699
• test(hmac): cover label/spec/kid accessors and jwk use field across all specs by @EffortlessSteven in #700
• fix(cli): mark public asymmetric JWKs scanner-safe in runtime bundles by @EffortlessSteven in #691
• badge: refresh public endpoints by @github-actions[bot] in #704
• test(cli): cover runtime JWKS scanner-safe metadata by @EffortlessSteven in #706
• refactor(x509): split self-signed cert builder into SRP submodules by @EffortlessSteven in #694
• xtask: add adoption-regression receipt by @EffortlessSteven in #713
• test(jwk): cover builder and negative fixture branches by @EffortlessSteven in #714
• test(entropy,hmac,ed25519): cover fixture invariants by @EffortlessSteven in #727
• test(pkcs11-mock): cover invalid-handle paths, domain constant, and copy/clone semantics by @EffortlessSteven in #707
• test(test-server): cover spec builders, phase accessors, and error variants by @EffortlessSteven in #710
• test(axum): cover builder methods, rotation phases, and middleware reject paths by @EffortlessSteven in #709
• test(rustls): cover default-provider mTLS config builders by @EffortlessSteven in #712
• badge: refresh public endpoints by @github-actions[bot] in #705
• fix(x509): remove self-signed generation panic debt by @EffortlessSteven in #732
• test(token): add mutant_killers and extra_coverage for derivation pins by @EffortlessSteven in #733
• test(pgp): pin DOMAIN constant, file-write paths, and PgpSpec derives by @EffortlessSteven in #736
• test(token): cover negative_value JWT variants and isolation invariants by @EffortlessSteven in #737
• test(rsa): cover mismatch variant identity and JWKS embed by @EffortlessSteven in #734
• test(rsa): cover JWK output and kid across all RSA spec sizes by @EffortlessSteven in #740
• test(ecdsa): cover mismatch variant identity and JWKS embed by @EffortlessSteven in #738
• test(pgp): cover tempfile writers, untested CorruptPem arms, and clone identity by @EffortlessSteven in #739
• test(jsonwebtoken): cover header kid/alg/typ round-trips and Validation knobs by @EffortlessSteven in #741
• test(x509): cover params helpers and clone-share invariants by @EffortlessSteven in #742
• docs: close out adoption-confidence lane by @EffortlessSteven in #744
• docs: refresh adoption how-to version snippets by @EffortlessSteven in #745
• badge: refresh public endpoints by @github-actions[bot] in #743
• test(test-server): cover serve flags, cache policies, and discovery etag by @EffortlessSteven in #746
• test(cli): cover materialize kinds and label-normalization edges by @EffortlessSteven in #747
• test(axum): cover JWT claim fallbacks and missing-context rejection by @EffortlessSteven in #753
• release: prepare v0.9.1 by @EffortlessSteven in #761
• badge: refresh public endpoints by @github-actions[bot] in #749
• release: prove v0.9.1 candidate by @EffortlessSteven in #762
• release: cut v0.9.1 by @EffortlessSteven in #763

Full Changelog: v0.9.0...v0.9.1