v1.4.0

What's Changed

• [codex] Add EKS admin access path component by @kerberosmansour in #136
• [codex] Add MetricsServer component by @kerberosmansour in #138
• ticket-71: isolate release provenance signing by @kerberosmansour in #141
• ticket-139: migrate SecureBucket off S3 V2 by @kerberosmansour in #142
• ticket-47: expose AccountFoundation CloudTrail log group by @kerberosmansour in #140
• ticket-23: add KMS deny-without-tag modes by @kerberosmansour in #144
• ticket-16: add release checklist demo gate by @kerberosmansour in #143
• ticket-25: extract forbidden shortcut helper by @kerberosmansour in #145
• ticket-32: document integration stub pattern by @kerberosmansour in #147
• ticket-24: add AccountFoundation real AWS assertions by @kerberosmansour in #146
• ticket-24: classify s3api head-bucket 404 as missing resource by @kerberosmansour in #148
• ticket-24: make Startup-Hardened CloudTrail->CWL actually work (KMS grant + trail wiring) by @kerberosmansour in #149
• policies: add H5 — close forged-SecureBucket-URN raw-bucket bypass by @kerberosmansour in #150
• ticket-24: fix two more Startup-Hardened real-AWS deploy blockers (event-selector ARN + Config KMS) by @kerberosmansour in #153
• ticket-24: self-heal stale e2e IAM Access Analyzers (Startup-Hardened quota unblock) by @kerberosmansour in #154
• ticket-24: fix Config delivery for ACL-disabled bucket (drop x-amz-acl condition) by @kerberosmansour in #155
• ticket-24: drop ACL reqs from Config recorder role (ACL-disabled bucket) by @kerberosmansour in #156
• ticket-24: opt Config/CloudTrail delivery bucket out of Object Lock (root cause of the persistent InsufficientDeliveryPolicyException) by @kerberosmansour in #157
• ticket-24: make Startup-Hardened EventDataStore tear-down-able + sweep cost orphans by @kerberosmansour in #158
• Reusable OIDC / Istio / CI hardening (closes #160 #161 #162 #163) by @kerberosmansour in #164
• fix(policies): anchor GitHub OIDC issuer match in G_OIDC_1; share matcher (closes #165) by @kerberosmansour in #166
• Support SecureRepository adoption for existing repos by @kerberosmansour in #168
• Preserve repo settings during SecureRepository adoption by @kerberosmansour in #169
• Support SecureRepository ruleset adoption by @kerberosmansour in #170
• [codex] Refresh secure execution declarations by @kerberosmansour in #172
• ticket-24: record real-AWS both-tiers-green proof + close out contract by @kerberosmansour in #159
• docs: refresh README — Scorecard-style structure + accuracy fixes by @kerberosmansour in #173
• docs: README table of contents + surface AWS Operations / patch / vuln components by @kerberosmansour in #176
• security: fix 4 HIGH + 15 MEDIUM Codex findings (8 root-cause clusters) — DCO-signed replacement for #177 by @kerberosmansour in #178
• docs(deployment): sandbox IaC role trust policy now accepts environment-form subs by @kerberosmansour in #179
• release: v1.4.0 — security-hardening release (6 GHSAs) by @kerberosmansour in #186
• test(skill-bdd): lock sandbox-account.md :sub array shape (#182) by @kerberosmansour in #184
• test(skill-bdd): WF_ENV_1 --check-settings closes phantom-env gap (#183) by @kerberosmansour in #185
• fix(release): unblock v1.4.0 publish — upload-artifact path glob + diagnostic ls by @kerberosmansour in #187
• fix(release): upload-artifact include-hidden-files for dot-prefixed staging dir by @kerberosmansour in #188

Full Changelog: v1.3.2...v1.4.0