runner: v0.4.0

0.4.0 (2026-08-12)

Features

• ci: arm the Go coverage ratchet, and revive both badges that have been dead since July (#2001) (fa093c2)

Bug Fixes

• agent: bound the ACR token exchange with its own http client (#2203) (989e3da), closes #2037
• agent: derive the build Job name from the renderer instead of re-deriving it (#2194) (f1f836a), closes #2032
• agent: send the db-authproxy mysql error packet with sequence id 2 (#2208) (fd299a8), closes #2043
• agent: write the tofu plan artifact with utils.WriteSecretFile instead of a world-readable 0644 file (#2209) (84e5ecb), closes #2015
• caches: carry the allowed-CIDR list from the canvas to the deploy (#2155) (f62cfe2)
• console: pick the component lists explicitly, and give the subtree a CI detector before enforcing (#1980) (a8b29de)
• nosql: carry a global table's replica regions from the canvas to the deploy (#2175) (0b548f1), closes #1982
• obs: gate each OTLP signal on its own endpoint instead of OR-ing all three (#2226) (1338b28)
• provisioner: route a namespace-placement teardown away from the full-cluster tofu destroy (#2162) (66a556d)
• runner: AKS token minting worked only for workload identity (#1728) (117680b)
• runner: delete two vacuous deploy-validation tests and give the safety poll a test seam (#2227) (62c4dee)
• runner: derive the runner's own image ref instead of asking an operator for it (#1795) (1cddd19), closes #1787
• runner: fail closed on a config_snapshot key the contract does not model, and stop the DB-row spread that feeds it (#1973) (44bbcf6)
• sandbox: make Passthrough refuse a NoEgress spec instead of silently running it (#2163) (f11a96a), closes #2042