v0.4.0

Container image (linux/amd64, linux/arm64):
ghcr.io/kruatech/turna:v0.4.0

Supply chain

The image is cosign-signed (keyless) and carries SLSA
provenance + SBOM attestations. Verify:

cosign verify ghcr.io/kruatech/turna:v0.4.0 \
  --certificate-identity-regexp '^https://github.com/kruatech/turna/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Binary tarballs ship with .sha256 checksums and an SPDX SBOM
(*.spdx.json), plus a GitHub build-provenance attestation.

What's Changed

• docs: add the OpenSSF Best Practices badge by @kruatech in #111
• fix(health): refuse to start when the health port cannot be bound by @kruatech in #112
• SCTP hardening, AF_XDP validation, DTLS log noise, RFC 6062 gate by @kruatech in #113
• Enterprise readiness: RBAC, revocation, capacity thresholds, and a shutdown defect that was always there by @kruatech in #121
• deps(docker): bump debian from abd67ff to 8820086 in /deploy by @dependabot[bot] in #114
• deps(docker): bump rust from e70e2ee to 82150a5 in /deploy by @dependabot[bot] in #115
• ci: bump github/codeql-action/init from 3.37.3 to 4.37.9 by @dependabot[bot] in #120
• deps: bump aes-gcm from 0.11.0 to 0.11.1 by @dependabot[bot] in #118
• ci: bump actions/checkout from 4 to 7 by @dependabot[bot] in #116
• Address the CodeQL 4.x findings by @kruatech in #122
• docs: release 0.4.0 by @kruatech in #123

Full Changelog: v0.3.1...v0.4.0