v0.2.1

Changelog

• 7867545 analyzer: mask before encoding, bound retained bytes, report timing
• 3bd9a08 ci: release the tag that triggered the workflow
• 94a75c9 deploy: give the API token only to the analyzer's reader container
• c310ccb docs: add the analyzer to the architecture and roadmap
• 62e7369 docs: document v0.2.1 security fixes and known limitations
• 2f08b34 kube: require a ready Pod running the image before offering a restore
• b6fe721 release: prepare v0.2.1
• aefc782 watch: mask every cluster-controlled alert field