v0.1.0-rc.4

Kova v0.1.0-rc.4 is a prerelease focused on completing the managed Service
workflow and validating the published artifact set.

Highlights:

• Adds authenticated, owner-aware Service jobs with submit, list, wait, logs,
  results, cancellation, retention, and cleanup flows.
• Adds multi-target batch Service jobs and verifies pushed image descriptors
  before reporting success.
• Adds S3-compatible artifact storage and an end-to-end MinIO lifecycle gate.
• Strengthens TokenReview and SubjectAccessReview RBAC boundaries.
• Validates upgrade and rollback behavior, public chart pulls, role-specific
  runtime images, checksums, SBOMs, and build provenance before publication.

Install the matching public chart:

export KOVA_VERSION=v0.1.0-rc.4
helm show crds oci://ghcr.io/cofy-x/charts/kova \
  --version "${KOVA_VERSION#v}" | kubectl apply -f -
helm upgrade --install kova oci://ghcr.io/cofy-x/charts/kova \
  --version "${KOVA_VERSION#v}" \
  --namespace kova \
  --create-namespace \
  --wait

Apply the selected release CRDs before every Helm upgrade because Helm does not
upgrade files from a chart's crds/ directory. Verify downloaded CLI and chart
assets with checksums.txt.

Full changelog:
v0.1.0-rc.3...v0.1.0-rc.4