v0.10.0

Changelog

• ecb3f62 Bump docker/login-action from 4.5.2 to 4.6.0
• e68ae43 Merge branch 'main' into chore/prepare-v0.10.0
• fcf1e09 Merge pull request #21 from krisiasty/fix/notice-a-replaced-credential
• dd94e98 Merge pull request #28 from krisiasty/fix/fail-closed-on-contested-secret
• 64fec20 Merge pull request #29 from krisiasty/fix/surface-renewal-failures
• abf95c0 Merge pull request #30 from krisiasty/fix/starving-reconciliation
• 8ca036e Merge pull request #31 from krisiasty/feat/report-rejected-objects
• 4c1d555 Merge pull request #32 from krisiasty/agent/prevent-reserved-secret-metadata
• c0cb6ae Merge pull request #33 from krisiasty/feat/pin-supply-chain
• f84960a Merge pull request #34 from krisiasty/fix/verdict-test-flake
• 09443c8 Merge pull request #35 from krisiasty/dependabot/github_actions/docker/login-action-4.6.0
• 3cde9d8 Merge pull request #36 from krisiasty/chore/prepare-v0.10.0
• 73bac89 add a dry run of the release path
• c705996 assert the pinned buildx is the one that gets used
• 8fb0bcf close the window between a pass writing and a verdict arriving
• 3f56ecb fail closed when two connections claim one Secret
• 795c7c5 fail the pass when the published credential is overwritten
• 9ab0e36 fix a flaky verdict test, and the race under it
• 88e8ab1 fix immutable release tool pins
• db4eba8 let the verdict outrank a pass that was already running
• 6b4e87f merge main: bring in the verdict-test flake fix
• 2c5c6ab notice a credential written over by something else
• 0a83cdc pin everything the release path pulls in
• 2daeb47 point the dry run at the branch under review
• 471095f prepare v0.10.0: chart 0.3.0, docs on the new tag
• 38ce788 preserve reconciliation for reserved metadata
• b27696b publish a snapshot without letting go of the lock
• 912568d recheck a queued pass, and judge readiness on this process
• 1a2e2a7 record the credential that was sent, not the one that came back
• 0808740 reject reserved secret metadata
• 534cc5a say "unknown" when the expiry is unknown
• 1fc6dc9 say on the object why a cluster is not being reconciled
• 51ae71e settle verdict clears during status writes
• df32ebd stop one stuck cluster from holding up the fleet
• 11e1d50 surface renewal failures before they become a lockout