v0.7.8

What's fixed

• Retained resources no longer pile up in the ledger. When a retained SQS queue, SNS topic, S3 bucket or DynamoDB table is let go, its entry now leaves status.managedResources unless it pins an encryption key. Before, a CR that kept replacing retained resources grew its status until writes were rejected at the object size limit. Declaring the resource again still needs adopt. A ledger past 300 entries raises a LedgerLarge warning.
• Final snapshots of removed RDS instances are forgotten once they are gone. The entry is checked about daily after the instance has left the ledger, and dropped when the snapshot is deleted. Before, it kept the snapshot's encryption key from being released.
• No more empty status patches. A reconcile that changes nothing now writes nothing.
• The cache no longer loses ConfigMaps and Secrets when another tool rewrites app.kubernetes.io/managed-by. The operator filters on its own cloudctl.io/managed label. Before, a rewritten label made the watch go blind and caused a re-apply on every pass.
• Less memory for ServiceAccounts. The cache keeps only the operator's own field managers.
• A CR with resources in another region is refused (RegionChanged) instead of being reconciled by an operator in the wrong region, where queues looked missing and were recreated empty. Deletion is refused too, and nothing is touched.
• Long waits are polled less often. After 10 consecutive failures a CR is retried at the drift interval (about 5 minutes). A kmsKeyRef that isn't ready and IAM's "some consumed resources could not be granted yet" now wait for a change to end them instead of polling.

Upgrade notes

• On the first pass, ConfigMaps and Secrets that carry only the old label get the new one through one apply each, and unencrypted retained entries are dropped from the ledger.
• A CR whose ledger names resources in another region now reports RegionChanged. Run an operator in that region for it.
• No spec, CRD, chart or IAM changes.