v0.5.0

New features

• Data Olympus can now tell you when a newer version has been published. The
  running server checks PyPI and GitHub in the background and surfaces a
  latest_version / update_available signal in kb_health and the health
  endpoint, so deployments that do not auto-update can see at a glance that they
  are behind. Air-gapped installs can turn the check off with
  KB_DISABLE_VERSION_CHECK=on.

• A first-class reverse-proxy host allowlist. Set KB_PUBLIC_HOSTNAMES to the
  hostnames your server is reached by, and Data Olympus configures the HTTP
  layer's Host-header protection for you (instead of reaching for the underlying
  dependency's env var). If you bind a public address with host protection on
  and no hostname allowed, the server now warns loudly at startup, so the silent
  "readiness green, every request rejected" failure mode can no longer catch you
  out.

• An optional Prometheus /metrics endpoint. Install the metrics extra and
  GET /metrics exposes queue depths, push-failure and staleness counters, live
  session counts, per-tool call counts, and index-build timing, so a
  governance-critical single-writer service becomes alertable instead of
  log-grepped. Without the extra installed, nothing changes and the route
  returns 501.

• Legacy corpus status migration. Documents from pre-0.4.0 corpora that predate
  the mandatory status field now default to active in the search index (with
  KB_STATUS_AUTOFILL=on, the default), so they stay searchable and in-force on
  upgrade instead of silently dropping out. A data-olympus migrate status
  command persists the field to the files when you want it written to disk.

Release safety

• Publishing a version that already exists on a registry is now blocked. The
  release pipeline refuses to republish an existing X.Y.Z to PyPI, ghcr, or a
  GitHub release/tag, so a published version stays immutable. A legitimate
  re-run of the same commit is still allowed.

Fixed

• The demoted_writes reminder in kb_consult now reflects the entries that are
  actually still awaiting review for your session, rather than a session-lifetime
  count, so it stops nudging you about demotions that are already resolved.