0.32.0

Added

• ess infra import openapi imports OpenAPI 3.0 documents instead of refusing them at
  /openapi. Each schema is rewritten to its 3.1 form: boolean exclusiveMinimum/exclusiveMaximum
  fold into the numeric keyword, and nullable: true becomes the null union, whose null member
  is a feature-unpreserved gap at …/nullable because the interface has no null. A 3.0 construct
  with no faithful 3.1 form (nullable beside $ref, a boolean bound without its minimum or
  maximum) is refused at its own pointer. Swagger 2.0 is refused at /swagger.
• OpenAPI 3.1 type: [<type>, "null"] imports as <type> with the same null gap at …/type,
  so the 3.0 and 3.1 spellings of one meaning agree; it was refused as a type array. Other 3.1
  imports are byte-identical.
• ess verify bindings reports OBS-BIND-008: a container or native sidecar (initContainers
  with restartPolicy: Always) in a bound workload's template that no binding names is a
  violation naming it, and a binding may name a native sidecar. Plain init containers are not
  checked, and the detail says so. The report is now ess-observed-bindings-report/2. The input
  stays ess-observed-bindings/1, and its meaning widens: binding a workload claims it runs
  nothing else, so a document whose bound workload carries an unbound sidecar, which was
  satisfied, is now violated.
• The namespace-topology collector keeps initContainers, sanitized like containers, and writes
  the key even when a template has none. The infrastructure model records native sidecars in an
  optional native_sidecars field: absent when the observation did not record init containers,
  empty when it recorded none. Before 0.32.0 the field is written only for a native sidecar or an
  explicit initContainers: []; a missing key or a list of plain init containers only, and any IR
  without the field, leaves OBS-BIND-008 unknown rather than satisfied, naming the producer
  version. Every such document keeps the bytes and digest ESS 0.31.0 computed for it.
• task infra-acceptance accepts one generated service placement against a disposable k3d
  cluster it creates and deletes: live observation, a projection produced twice and compared,
  three sensitivity cases, a Secret redaction check on every written byte, and verified teardown.
  It needs Docker and stays out of task check.

Fixed

• --path and --spec help no longer calls the system.yaml directory layout "legacy". It is a
  supported layout and the one a first specification starts from; the reference page on directory
  input says so too.
• ess verify conform synthesize orders two Timestamp values by the RFC 3339 instant they name
  (+01:00 and Z spellings included), in a guard over two fields or against an instant
  literal. It refused every such guard with "no declared scale contains both values".
• ess specify validate refuses what synthesize cannot decide, with the same reading in both:
  a bare word on the right-hand side that names a declared field (ends_at > starts_at compares
  against the text "starts_at") is refused and the message names the working spelling
  (window.ends_at > window.starts_at); ordering a Timestamp against text that is not an
  instant is refused. A bare word that is a variant of the compared enum is unchanged.