v0.23.0

What's Changed

• docs: add a terminal demo GIF to the README by @Jaro-c in #312
• docs: promote README demo GIF to main by @Jaro-c in #313
• fix(installer): verify keyring signature and remove insecure bypass by @Jaro-c in #323
• fix(compose): drop-in parity for include, extends, networks, profiles by @Jaro-c in #324
• fix(quadlet): faithful export of users, secrets, external resources, SELinux by @Jaro-c in #325
• fix(engine): warn on rootless-ineffective resource controls by @Jaro-c in #326
• test(engine): cover zip-slip guard, deterministic lock-contention test by @Jaro-c in #327
• docs: security model, independent + air-gapped verification, man SECURITY by @Jaro-c in #329
• ci: air-gapped deb build, SBOM, license attribution, DCO enforcement by @Jaro-c in #328
• feat(cli): hidden command aliases and blank-line-framed help by @Jaro-c in #330
• release: government-readiness remediation (34 findings) by @Jaro-c in #331
• refactor(engine): native libpod secret injection for inline secrets/configs by @Jaro-c in #332
• docs: switch install URLs to per-OS //install/{unix,windows,apt} by @Jaro-c in #334
• release: v0.23.0 by @Jaro-c in #335
• release: v0.23.0 — native libpod secret injection by @Jaro-c in #336
• ci(release): fix SBOM mv self-collision by @Jaro-c in #337
• release: v0.23.0 (SBOM publish fix) by @Jaro-c in #338

Full Changelog: v0.22.2...v0.23.0