v0.33.0

Changelog

• 6a38060 Merge pull request #224 from cozystack/security/cve-2026-53359-disable-nested-virt
• 1ff68bd fix(charts): pin grubUseUKICmdline=false so nested-virt args apply on v1.12+
• 6b58604 fix(charts): disable KVM nested virtualization in Talos presets (CVE-2026-53359)
• 90372d3 Merge pull request #216 from cozystack/feat/chart-drift-detection
• dcd0c77 Merge branch 'main' into feat/chart-drift-detection
• 170cdbe docs(manual-test-plan): note that --force bypasses the edit-preserving diff
• a49ca47 docs(readme): show .talm-preset.lock in the project tree
• edb7f84 test(cli): pin the Chart.yaml strictCharts channel and the strict-source OR
• a44d621 fix(build): classify describe-suffix and dirty builds as non-release
• 6031d46 fix(init,commands): make init --update an exact re-sync; name drifted paths
• 3dc254a fix(cli): make strict mode block on unverifiable or missing drift baselines
• e28d34e fix(commands): treat CRLF line endings as checkout artifacts, not drift
• 31b6fdb fix(init): validate inferred preset before --update writes anything
• 957c873 test(commands): pin malformed .talm-preset.lock failure modes
• 9669a55 docs(manual-test-plan): clear simulated drift with the project's own preset
• 7d564d6 fix(cli): align --strict-charts help with the actual re-sync command
• 6af1a7b fix(charts): anchor Chart.yaml metadata normalizer to top-level keys
• 5e9dfc2 feat(version): detect preset-template drift via .talm-preset.lock
• ad56f0e docs: document chart vendoring and drift detection
• 45cafe5 feat(version): warn when vendored charts drift from the talm binary
• dbc2a57 feat(commands): detect vendored charts/talm drift by content
• 8c9288b feat(charts): add content digest for the embedded talm library