v1.21.0

One key, for a directory small enough to read at a glance.

✨ Features

search: false turns the header search box off. On by default, so a site
that does not set it renders exactly what it did before. Asked for on #111 by
@AntonPalmqvist, whose directory is four services in one category with no
header links: there the box sits alone on a row that exists for it, and with
that row gone the first category starts 70px higher on a desktop and 58px
higher on a phone.

It takes the whole control rather than the visible half: the live box, the
disabled copy every other page carries so the header keeps its shape from page
to page, the script, and the Cmd+K bound inside it. There is no cheaper
cosmetic version, and the reason is worth knowing: cairn's search filters the
card grid in place rather than opening a palette, so a hidden box would have
nowhere to put what you type.

The row it lived in then holds nothing, on a site with no header links, and an
empty one still drew its border as a bare strip across the page. It collapses
now, the way a card foot with no flag and no pill already did.

🧹 Internal

The image's compiler moved from the 1.26 line to the 1.27 line, and the
shipped binary says so rather than the Dockerfile: go version reads go1.26.6
on the published 1.20.2 image and go1.27.1 on this one. Dependabot proposed
both halves, the tag and the digest underneath it, and both landed through the
seven-day cooldown and the required checks. codeql-action went from 4.37.7 to
4.37.9 the same way.

The comment on that pin claimed nothing moved it automatically, named a digest
two digests old, and quoted a Dependabot log line from the older policy. It now
describes what actually happens, and names no digest of its own, since the copy
of the one on the FROM line is what went stale.

Three browser checks added, 85 in total, each proved red by deleting what it
guards, and each deletion reached only its own. The one that carries the
others is the control: the same keystroke on the same build, on the page where
search is on, still has to land in the box. Without it the first check would be
measuring the keyboard rather than the switch.

📦 Image

docker pull morgankryze/cairn:1.21.0   # or: ghcr.io/morgankryze/cairn:1.21.0

This release also moves 1.21, 1, stable and latest, on both registries.
Docker Hub gets the digest ghcr signed, copied rather than rebuilt, so the two
are the same object and cosign verify works on either. The chart is at
oci://ghcr.io/morgankryze/charts/cairn version 1.21.0, signed the same way:

cosign verify morgankryze/cairn:1.21.0 \
  --certificate-identity-regexp '^https://github.com/MorganKryze/cairn/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Upgrading needs nothing: no config shape changed, search is opt-out, and
-check on 1.21.0 accepts everything 1.20.2 accepted.