v0.2.2

Hardening release. No change to checks or verdicts.

• Signed releases: checksums.txt is now signed with keyless cosign (Sigstore). It covers every archive and sits alongside the existing build attestation:

  cosign verify-blob --bundle checksums.txt.sigstore.json \
    --certificate-identity-regexp 'https://github.com/Rusty-Gopher/kupre/' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt

• go install builds report their real version instead of dev.
• Install with Homebrew (brew install rusty-gopher/tap/kupre) or krew (kubectl krew index add rusty-gopher https://github.com/Rusty-Gopher/homebrew-tap && kubectl krew install rusty-gopher/kupre).
• Supply chain: every GitHub Action is pinned by commit SHA, workflow permissions are scoped per job, and CodeQL, staticcheck, OpenSSF Scorecard and Dependabot are in place.
• Fuzz tests for --target-version parsing and .kupre.yaml loading. The policy fuzzer asserts that no policy can unblock a blocker without an explicit severity override.