Bug fixes

Empty --attachments or --template elements (e.g. from unset shell variables) are now rejected with a clear error instead of being silently dropped.
An empty KOSLI_CONFIG_FILE environment variable no longer suppresses config file loading; it is treated as unset and falls back to the default.
An empty KOSLI_API_TOKEN environment variable no longer skips decryption of a config-file token.
A boolean flag given an empty value (e.g. --compliant "" or --new-compliance-status "") is now rejected with a clear error naming the flag, preventing the opposite compliance verdict from being recorded silently.
Config file or environment values that cannot be applied to a flag now produce an error naming the flag and its source, instead of silently failing.

What's Changed

fix(attest): always serialise commits in pull request attestations by @dangrondahl in #1083
fix(docs): correct invalid regex in snapshot ecs help examples by @dangrondahl in #1080
fix(config): treat empty KOSLI_* env vars as unset, not as set by @JonJagger in #1089
fix(config): report config values that cannot be applied to their flag by @JonJagger in #1090
fix(flags): reject an empty element in a multi-value flag by @JonJagger in #1092
fix(flags): reject an empty value written after a boolean flag by @JonJagger in #1091
chore(deps): bump the github-actions-dependencies group with 3 updates by @dependabot[bot] in #1084
chore(deps): bump the go-dependencies group with 9 updates by @dependabot[bot] in #1085
chore(deps): bump anthropics/claude-code-action from 1.0.189 to 1.0.191 in the github-actions-dependencies group by @dependabot[bot] in #1094
chore(deps): bump the go-dependencies group with 7 updates by @dependabot[bot] in #1095
chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in #1096

Full Changelog: v2.36.5...v2.36.6