v0.5.1

Correctness fixes, found by an independent review.

• Every add-on install is now checked. Previously only the first matching workload was checked, so a compatible Cilium or cert-manager could hide an older second copy (another namespace, a half-finished migration). Now all installs are evaluated, and any install newer than kupre's data prevents a pass.
• kubernetes-version-support no longer passes when the target's end-of-life date is unknown. It reports the current release's status and says the target is unknown.
• kupre fleet applies .kupre.yaml (--policy, --no-policy), so fleet verdicts match single-cluster runs.
• GitHub Action:
  • fail-on is now the only threshold; a --fail-on-warn in args can no longer override it.
  • Invalid fail-on values are rejected.
  • Each invocation writes its own report, so a scan that fails early can't publish an earlier scan's verdict.

Install: brew install rusty-gopher/tap/kupre · kubectl krew install rusty-gopher/kupre · go install github.com/Rusty-Gopher/kupre/cmd/kupre@v0.5.1 · ghcr.io/rusty-gopher/kupre:0.5.1 · checksums cosign-signed.