v0.46.0

A minor release that adds ankra secrets, so an organisation's secrets can be
created, replaced, rotated and deleted from a terminal or a script without the
value ever appearing on a command line, in a file you commit or in a model's
context. A stack, add-on or application references a secret by its
${SECRET_SLOT:<id>} sentinel, and Ankra resolves it at deploy time. It also
lets Ankra Cloud clusters size and tier each server's root disk, and adds
ankra org access-gateway status|zones|get|set.

Added

• ankra secrets manages the organisation's secrets without the value ever passing through a command line, a file you commit or a model. create <name> stores a value and prints its ${SECRET_SLOT:<id>} sentinel on stdout, to put where the value belongs (at a key encrypted_paths declares; Ankra substitutes the value when it seals the file). The value comes from --generate (Ankra creates it and nobody sees it), --from-file (byte for byte) or stdin (a masked prompt on a terminal); a value given as an argument is refused with exit 2, without echoing it. list shows each secret's name, id, whether a person or Ankra supplied it, the resources that reference it, when it was last read and when it expires, never a value. set and rotate [--generate] replace a value in place, so the sentinel and everything that references it stay valid. delete asks first, and a secret that deployed resources still reference is refused with each of them named (exit 1); there is no force. Every command takes --org and -o json.
• The agent skills recommend ankra secrets for values that must not live in Git. ankra-sops-secrets, ankra-security, ankra-app-integrations and ankra-cli now say when a secret slot is the right home, how to reference its sentinel, and that a generated slot expires unless a deployed resource references it.
• Ankra Cloud clusters can size each server's root disk and choose its storage tier. ankra cluster ankracloud create and preflight take --bastion-disk-gib, --control-plane-disk-gib, --etcd-disk-gib and --worker-disk-gib, and the matching --*-disk-tier flags (local-nvme, standard, maxiops or hdd). ankra cluster node-group add takes --disk-gib and --disk-tier, which apply to every server a node group creates, scale-ups included. A size or tier you leave unset is not sent, so the server takes its plan's included disk on the zone's default tier. Put CI workers on small local-nvme disks when their data lives on persistent volumes. The preflight counts the chosen sizes against the account's storage quota, and Ankra Cloud refuses a size below the plan's and the template's minimum. The disk flags are refused on other providers, and node-group list shows disk=<n>GiB/<tier> for a group that chose either.
• ankra org access-gateway status checks a Platform and Cloud relay deployment together. It reads live workloads and Secret references through Ankra, and supports JSON/YAML output without revealing credentials. Pass --platform-cluster and --relay-cluster to name the two clusters. Token equality and a browser SSO login remain separate checks.
• ankra org access-gateway zones|get|set manages Cloud DNS proxy policies with an Ankra login. List the organisation's Cloud zones, inspect an effective access policy, or set --mode public|organisation with optional repeated --role values. The Platform checks organisation membership and members.manage before forwarding a policy change to Cloud.