v0.18.0

What's Changed

• fix(security): close fail-open defaults, header spoofing, and add CSP by @jinglemansweep in #368
• fix: silent config drops, metrics event-loop stall, and route/decoder bugs by @jinglemansweep in #369
• fix: readiness 503s, maintenance gating, cache invalidation, and webhook/engine hardening by @jinglemansweep in #370

Full Changelog: v0.17.3...v0.18.0