v0.20.0

What's Changed

• build: strip third-party debuginfo to fix disk-full CI flake by @vieiralucas in #1724
• ci: relocate cargo target to /mnt to kill disk-full flake by @vieiralucas in #1725
• ci: retry flaky external downloads by @vieiralucas in #1727
• ci: matrix fail-fast, docker concurrency, fail-loud release artifacts by @vieiralucas in #1728
• test(e2e): poll for SQS delivery instead of one-shot receive by @vieiralucas in #1729
• ci: fail fast on hung tests and jobs (timeouts) by @vieiralucas in #1726
• feat(ec2): real Docker/Podman-backed instances (runtime 1/3) by @vieiralucas in #1730
• feat(ec2): native Kubernetes Pod backend for instances (runtime 2/3) by @vieiralucas in #1731
• feat(ec2): GetConsoleOutput backed by container logs (runtime 3/3) by @vieiralucas in #1732
• docs(ec2): describe real container-backed instances across website + llms by @vieiralucas in #1737
• feat(lambda): configurable k8s Pod nodeSelector, tolerations, and annotations by @WarpRat in #1733
• ci: bump GitHub Actions off deprecated Node.js 20 runtime by @vieiralucas in #1738
• feat(sdk,introspection): expose EC2 instance backing container id by @vieiralucas in #1736
• chore(aws-models): weekly refresh from aws/api-models-aws by @github-actions[bot] in #1735
• ci(sdk): build fakecloud once, share binary across all SDK e2e jobs by @vieiralucas in #1739
• fix(rds): persist Tags supplied to CreateDBInstance by @WarpRat in #1740
• feat(rds): configurable k8s Pod nodeSelector, tolerations, and annotations by @WarpRat in #1741
• feat(ecs): configurable k8s Pod nodeSelector, tolerations, and annotations by @WarpRat in #1743
• feat(ec2): configurable k8s Pod nodeSelector, tolerations, and annotations by @WarpRat in #1744
• feat(elasticache): configurable k8s Pod nodeSelector, tolerations, and annotations by @WarpRat in #1742
• fix(ec2): update k8s_integration test for run_instance tags arg by @vieiralucas in #1746
• fix(dynamodb,ecr,ecs,sqs,kinesis): fix persistence/restart data-loss and stream-iterator desync by @vieiralucas in #1752
• fix(ecs,rds): close container delete/stop-during-create races and ECS reaper label gap by @vieiralucas in #1749
• fix(stepfunctions): guard JSONPath parsing against malformed paths (panic -> dropped connection) by @vieiralucas in #1748
• fix(kinesis,sns,kms,iam,s3,eventbridge): correct silent-wrong-output divergences from AWS by @vieiralucas in #1750
• fix: Tier-1 medium/low API divergences across 10 services (bug-hunt 2026-06-15 batch 7) by @vieiralucas in #1753
• fix(ec2): async lifecycle, restart reconcile, real instance attributes, count/filter/pagination correctness by @vieiralucas in #1747
• fix(lambda,iam,s3,cognito): close auth-enforcement gaps (unmapped actions, phantom-role federation, JWT exp) by @vieiralucas in #1751
• feat(ec2): seed default VPC topology on boot (#1745 phase 1) by @vieiralucas in #1754
• feat(ec2): per-subnet docker networks for L3 isolation (#1745 phase 2) by @vieiralucas in #1755
• feat(ec2): security-group + NACL nftables enforcement (#1745 phase 3) by @vieiralucas in #1756
• feat(ec2): k8s NetworkPolicy enforcement for security groups (#1745 phase 4) by @vieiralucas in #1757
• feat(ec2): instance-networks introspection endpoint + SDKs + docs (#1745 phase 5) by @vieiralucas in #1758
• docs(sdk): EC2 introspection section in SDK references (#1745 follow-up) by @vieiralucas in #1759
• fix(ec2,docker): ship nft in the image + document SG-enforcement enable path by @vieiralucas in #1760
• fix(ec2): default-VPC region coherence + CreateDefault idempotency + delete protection by @vieiralucas in #1761
• fix(ec2): re-apply SG firewall after restart-recovery and reboot by @vieiralucas in #1762
• fix(ec2): NACL rule-number precedence + reject out-of-range NetworkPolicy ports by @vieiralucas in #1763
• fix(ec2): honest enforcement status + subnet IP + nft sanitize + serialize reconcile by @vieiralucas in #1764
• test(ec2): real packet-filtering E2E + privileged CI job + image nft smoke by @vieiralucas in #1765
• test(ec2): harden real SG-enforcement test against reconcile-timing flake by @vieiralucas in #1768
• fix(cloudformation): persist provisioned resources across restart by @WarpRat in #1767
• chore(release): bump workspace to v0.20.0 by @vieiralucas in #1769

Full Changelog: v0.19.1...v0.20.0