v0.5.0

What's Changed

• Add Go fuzz targets for references, Compose import and agent inventory by @Yoshiofthewire in #149
• Silver criteria: repeatable build, release verification, coding standard, assurance case by @Yoshiofthewire in #150
• docs: add license, contributing, security, and code of conduct by @Yoshiofthewire in #151
• Add OpenSSF Best Practices and Scorecard badges by @Yoshiofthewire in #152
• feat(web): an Access page for service tokens, agent tokens and registries by @Yoshiofthewire in #153
• Enforce signing-key floors and support strong TLS for KyYard by @Yoshiofthewire in #154
• KyYard: shared Appearance cards and suite shell scale by @Yoshiofthewire in #155
• use the shared Match system label in Appearance by @Yoshiofthewire in #156
• test: run installer OIDC regression in CI by @Yoshiofthewire in #157
• test: gate releases on real-browser regressions by @Yoshiofthewire in #158
• chore(deps): bump the go group with 2 updates by @dependabot[bot] in #159
• chore(deps): bump alpine from 294b683 to be26560 by @dependabot[bot] in #160
• chore(deps): bump golang from f2c872b to b8c9b82 by @dependabot[bot] in #161
• chore(test-deps): bump @playwright/test from 1.63.0 to 1.64.1 in /tests/browser by @dependabot[bot] in #162
• chore(ci): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 in the actions group by @dependabot[bot] in #163
• feat(sso): honour OpenID Connect back-channel logout by @Yoshiofthewire in #164
• Bump golang.org/x/net to v0.62.0 (GO-2026-6860) by @Yoshiofthewire in #165
• test(sso): give each test IdP a unique issuer path (fix flaky strong-key CI) by @Yoshiofthewire in #166
• Sync ky-ui 0.4.3: field and status contrast by @Yoshiofthewire in #167
• Test: make regex anchors explicit (CodeQL missing-regexp-anchor) by @Yoshiofthewire in #168
• docs: add OctoCounts badge to the License section by @Yoshiofthewire in #169
• ci: run strong-key race suites in parallel legs; stagger cron by @Yoshiofthewire in #170
• ui: label SSO button "Continue with Single Sign On" by @Yoshiofthewire in #171
• ci: give every non-PR run its own concurrency group by @Yoshiofthewire in #172
• Start the 0.5.0 release line by @Yoshiofthewire in #173
• Cluster page: auto-check workload updates only in granted namespaces by @Yoshiofthewire in #174
• Give a registry redirect its own update-check verdict by @Yoshiofthewire in #175

Full Changelog: v0.4.4...v0.5.0