v1.6.1

What's Changed

• terraform: decision-token secret wiring, per-contract enforce staging, API enablement by @cesteral in #82
• deploy: first-apply hardening + first-deploy checklist by @cesteral in #83
• feat(terraform): fleet-side invoker grant (governance-invoker SA) + dev tfvars gitignore fix by @cesteral in #84
• deploy: first Cloud Run rollout of the MCP fleet + the bugs it shook out by @cesteral in #85
• fix(init): grant Cloud Build builder role to the Compute Engine default SA by @cesteral in #86
• feat(terraform): fleet load balancer — one custom domain for all 13 servers by @cesteral in #87
• Lock cross-repo attestation hash parity + release-workflow pin by @cesteral in #88
• docs: document governance wiring in new-server onboarding guide by @cesteral in #89
• docs: correct CLAUDE.md contract-package and SA360 references by @cesteral in #90
• ci(publish): guard against a governed package shipping no attestation manifest by @cesteral in #91
• harden(contract-hash): route computeDefinitionHash through stableStringify guard by @cesteral in #92
• refactor(contract-hash): route computeDefinitionHash through stableStringify by @cesteral in #93
• docs(changelog): ready @cesteral/contract-hash 1.1.1 for release by @cesteral in #98
• docs(contract): clarify schemaVersion number→string boundary in manifest builder by @cesteral in #96
• Validate cesteral annotation at manifest time; exempt create from entityIdArgs by @cesteral in #99
• Pin base image by digest and gate prod deploys by @cesteral in #100
• fix(governance): fail closed for effect-class writes + surface fail-open default + tighten entity dry-run type (#101, #102, #95) by @cesteral in #104
• fix(meta-mcp): align bulk_update_status cesteral.platform to "meta_ads" by @cesteral in #106
• test(scripts): add write-tool mislabel ratchet to detect mutation-named non-writes (#107) by @cesteral in #108
• test(governance): behavior-derived write detection for the coverage ratchet (#107) by @cesteral in #109

Full Changelog: v1.6.0...v1.6.1