v0.6.0

v0.6.0 — Rotation API Completion + Production Hardening

Features

• abort_rotation through full stack (Phase 8): genesis_abort_rotation exposed via Rust FFI and Go bridge. Rotation state machine can now cleanly transition from Rotating back to Active on error.
• Bootstrap traceability labels (Phase 8): Injected secrets now carry genesis.io/bootstrap-name and genesis.io/bootstrap-namespace labels, linking each secret back to its managing GenesisBootstrap CR.
• Rotation abort-on-error (Phase 9): BridgeRotationExecutor calls AbortRotation() when CompleteRotation() fails after BeginRotation() succeeds, emitting proper audit events and cleaning up state.
• Post-rotation verification (Phase 9): Controller validates secret existence, data key, and managed-by label after rotation. Best-effort (cache lag acknowledged); emits K8s events on mismatches.
• Rotation controller wired to Rust bridge (Phase 7): BridgeRotationExecutor runs the full rotation flow (New → Load → BeginBootstrap → InjectSecret → BeginRotation → CompleteRotation) entirely in Rust memory.
• AdditionalNamespaces via bridge (Phase 5): inject_secrets_multi FFI for multi-target injection in a single state transition.

Tests

• CLI output format regression tests: 6 tests validating exact filenames, YAML structure, SOPS config, file permissions, JSON output, and cross-file consistency.
• Rotation error + verification tests: 4 new test cases covering error handling and post-rotation validation.
• 202 Rust tests, 17 Go packages passing.

Fixes

• Go bumped to 1.26.1 for stdlib vulnerability fixes
• golangci-lint v2 built from source for Go 1.26 compatibility
• check-key-material scan widened to include internal/controller/
• Removed unused getProviderFactory after Phase 5 refactoring

Known Issues

• Identity filename mismatch (#8): genesis writes genesis-identity.key, launch expects age-identity.txt. Blocks pre-cluster secrets pipeline. Requires cross-project coordination.