v0.5.2: Registry pulls, DNS apex records, snapshot clones

Features in v0.5.2

Highlights

• Authenticated AOCR pulls for cluster snapshots and Firecracker templates.
• DNS apex records. Hostname ingress emits ANAME and ALIAS candidates so the zone apex can flatten to the ingress target.
• Snapshot clones reseed. The guest kernel is force-reseeded, a clone-generation signal fences the resumed sandbox, and vmgenid behavior is documented.

---

Registry, DNS, and clones

• Cluster snapshot restore and Firecracker template fetch present credentials to AOCR instead of pulling anonymously.
• Apex hostnames get ANAME/ALIAS candidates alongside the records already emitted for normal hostnames.
• A sandbox resumed from a snapshot does not reuse the parent's RNG stream.

Operations

• Terraform layout is reorganized and secret handling is split out of the non-secret config.
• Broader unit coverage for validation, sessions, image-pull errors, device lookup, and the Docker client.

What's Changed

• chore(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.21.4 in /sdk/java by @dependabot[bot] in #152
• chore(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 in /sdk/java by @dependabot[bot] in #153
• chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 by @dependabot[bot] in #154
• chore(deps-dev): bump tsx from 4.22.3 to 4.22.4 in /sdk/typescript by @dependabot[bot] in #155
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.43.0 to 1.44.0 by @dependabot[bot] in #156
• chore(deps): bump astro from 6.3.7 to 6.4.2 in /docs by @dependabot[bot] in #157
• chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.43.0 to 1.44.0 by @dependabot[bot] in #159
• tests: Enhance test coverage with validation and session handling tests by @sumansaurabh in #161
• test: add unit tests for image pull error classification and device retrieval by @sumansaurabh in #162
• Add comprehensive tests for Docker client functionality by @sumansaurabh in #163
• Refactor tests and increase coverage by @sumansaurabh in #164
• feat: add test cases around pkg by @sumansaurabh in #165
• refactor: reorganize Terraform configuration and enhance secret management by @sumansaurabh in #166
• feat: authenticated AOCR pull for cluster snapshots + Firecracker templates by @sumansaurabh in #167
• chore(deps): bump devalue from 5.8.0 to 5.8.1 in /docs by @dependabot[bot] in #168
• DNS: emit ANAME/ALIAS apex-flattening candidates for hostname ingress by @sumansaurabh in #169
• Snapshot-clone RNG correctness: kernel force-reseed + clone-generation signal + vmgenid docs by @sumansaurabh in #170

Full Changelog: v0.5.1...v0.5.2