rust-panosmcp v0.2.1

rust-panosmcp v0.2.1

v0.2.1 is a narrow maintenance release that makes PAN-OS configuration-lock
state truthful after commit and discard, and records the default-trusted TLS
lab rollout.

Fixes and operational changes

• Treat PAN-OS configuration-lock release as a confirmed state transition.
• Persist config_lock_held=false only after the device accepts unlock.
• Persist failed post-commit or discard unlocks as indeterminate with
  actionable reconciliation details instead of reporting false success.
• Preserve confirmed lock state across state-file restart.
• Deploy a default-trusted Let's Encrypt certificate for
  rust-panosmcp.mechub.org with tested Cloudflare DNS-01 renewal.
• Roll the DNS API credential, retain single-zone DNS-edit scope, verify the old
  token is rejected, and remove plaintext handoff artifacts.

Validation

• Final main CI passed build/lint/test, Rust 1.88 MSRV, supply-chain policy,
  fuzz-target compilation, reproducible archive, hardened container, and
  release-candidate packaging gates.
• The release image workflow published amd64/arm64 GHCR tags with provenance
  and SBOM attestations.
• The PAN-OS 12.1.5 lab completed an independently approved reversible change:
  apply, diff, full validation, and discard returned the candidate to its exact
  baseline with config_lock_held=false and no remaining PAN-OS config lock.
• The attached archive checksum was verified, the binary reports
  rust-panosmcp 0.2.1, and BUILD-INFO identifies commit
  7bb054a18fef06e15f8eba01f7b1c686e6bbc851.