v0.20.1

What's Changed

• ci(e2e): load br_netfilter at job level to de-flake SG enforcement test by @vieiralucas in #1774
• fix(s3,sqs): close three reachable request-path panics (DoS) by @vieiralucas in #1770
• refactor(ec2): store state collections in BTreeMap for deterministic iteration by @vieiralucas in #1772
• ci(e2e): retry SG enforcement scenario up to 3x to absorb setup-race flake by @vieiralucas in #1775
• test(eventbridge,ssm): assert real behavior; drop stale dead_code allow by @vieiralucas in #1771
• refactor(core,sns,s3,ses,cognito,route53): harden access-point routing + shrink pub surface by @vieiralucas in #1773
• fix(conformance): keep the probe sweep metadata-only so CI stops dying by @vieiralucas in #1777
• fix(sns): sign SubscriptionConfirmation with real AWS canonical string by @vieiralucas in #1778
• ci(e2e): verify + re-assert bridge-netfilter per SG-enforcement attempt by @vieiralucas in #1779
• fix(apigateway): use integrationHttpMethod for AWS (non-proxy) integrations by @vieiralucas in #1780
• fix(cloudformation): persist provisioned services on ExecuteChangeSet by @vieiralucas in #1781
• fix(secretsmanager): persist scheduled rotations through the snapshot by @vieiralucas in #1782
• fix(scheduler): persist ticker state mutations across restart by @vieiralucas in #1783
• fix(stepfunctions): persist execution terminal status + abort interrupted on restart by @vieiralucas in #1785
• fix(cognito): persist Hosted-UI OAuth2 mutations across restart by @vieiralucas in #1786
• fix(s3): guard inverted-XML slices in lifecycle + replication parsing (DoS) by @vieiralucas in #1787
• chore(release): bump workspace to v0.20.1 by @vieiralucas in #1784

Full Changelog: v0.20.0...v0.20.1