v0.3.3

See CHANGELOG.md

Container images (per runtime capability profile, ADR 000079):

• minimal: ghcr.io/kaikei-e/plecto@sha256:3abdb0b9bf200d8d389a5a6458edcc132527707e02178acd69a7bd5965c46418
• capabilities: ghcr.io/kaikei-e/plecto@sha256:a2fe1df2e0af1ba964b28e36b68217d5b046e61d1848ea5c8f12b0e7ab51c648

WIT contract (ADR 000064):

• ghcr.io/kaikei-e/wit/plecto/filter:0.3.0@sha256:184a0d1419ba6bd2a6d2b54acd3c53de0e278d2cc0feddf2791c20ee056b9981
• ghcr.io/kaikei-e/wit/plecto/filter-streaming:0.1.0@sha256:024a794a21d5c6ebf62397abf8d8c231f4b1cbfaa43e7f43975872eeba68d341 (experimental, off-by-default)

Reference filters (ADR 000080; compatibility matrix: docs/reference-filters.md):

• jwt 0.1.0: ghcr.io/kaikei-e/plecto/filters/jwt@sha256:d4568a07fe1627406ed2892c6e22def2d8de8912f8825d7379259a333710c8d9 (runtime profile: capabilities)
• cors 0.1.0: ghcr.io/kaikei-e/plecto/filters/cors@sha256:b8b380143140f120e4d3373f7594e8fa1962c1f2978e77052547304834c9599b (runtime profile: any (minimal+))
• apikey 0.1.0: ghcr.io/kaikei-e/plecto/filters/apikey@sha256:1e4c7014ccdf063808f953e9c97f2564152e72ed099ccb9c6430fc63e85ed7f5 (runtime profile: any (minimal+))
• extauthz 0.1.0: ghcr.io/kaikei-e/plecto/filters/extauthz@sha256:745ac52754b17a94e178b39badc22c011e7bb6752ee8539e0724ed7ea0bc07b9 (runtime profile: capabilities)

What's Changed

• chore(workspace): declare MSRV, hoist shared lints, unify wasm/webpki deps by @Kaikei-e in #75
• fix(host,control,server): review-driven hardening, adversarially re-v… by @Kaikei-e in #76
• Claude/dx reachability 000087 000089 by @Kaikei-e in #77

Full Changelog: v0.3.2...v0.3.3