v1.5.0

Changelog

• e7a30de Merge pull request #53 from deveshctl/feat/platform-flag
• d70df37 Merge pull request #54 from deveshctl/feat/testing-infra
• a500c99 Merge pull request #55 from deveshctl/feat/testing-infra
• e6b8a20 Merge remote-tracking branch 'origin/main' into feat/testing-infra
• 3d56be8 chore: add Scorecard, SLSA provenance, signed releases, Renovate (#58)
• ba423e6 chore: ignore internal-docs/ directory
• e1bc52b chore: release v1.5.0 (#61)
• 6700a08 ci(lint): broaden exclusions to suppress audited false positives
• e07d05f docs(readme): add Release, Go Reference, Go Report Card, Codecov badges (#60)
• d7179a4 feat(platform): add --platform flag for multi-platform images
• 7be0a54 feat(platform): polish error messages, surface platform in TUI/JSON
• 7ecee62 feat(tui): aggregated layer view (A keybind) (#57)
• 841db78 fix(archive): rewind file handle after platform check
• b1fe3f4 fix(build): suppress G602 on bound-checked --engine arg access
• 29d1d73 fix(ci): pin scorecard.yml actions to commit SHAs, not tag objects (#59)
• b7ff86c fix(platform): disclaim partial Available list on legacy image store
• fb01cc5 fix(platform): route 'no matching manifest' to platform classifier first
• f704a33 fix(release): migrate cosign signing to Sigstore bundle format (#62)
• 2f915ee fix(tui): copy sections into a fixed array to satisfy gosec G602
• 8262b10 fix(tui): remove duplicate Y keybinding in layers panel (#56)
• 226501d fix: resolve golangci-lint v2 findings on first run
• 2657f52 fix: satisfy gosec G602 bound analysis with explicit hints
• b4db97e refactor(platform): drop legacy-store fallback for available list
• 6ffc306 test(cmd): bump JSON golden schemaVersion to 1.0.1
• 1025a4b test(copyctx): replace dst.Len() poll with served-channel handshake