v0.3.0

Added

• A release can deploy itself. The release workflow has a deploy job
  between the build and the publish, which applies deploy/prod with the
  image pinned by digest, waits for the rollout and runs
  tools/smoke/release.sh against the live origin. It runs only where the
  repository variable SERMO_RELEASE_DEPLOY is set, so a fork publishes
  every artifact and deploys nothing. deploy/prod holds Latere's
  production manifests and deploy/bootstrap the identity the job deploys
  with and the one policy an operator applies by hand.
• GET /v1/messaging/version is public. It answers the build's
  version, commit and build_time with no token, so a deployment
  behind an ingress that forwards only /v1/messaging shows which release
  it runs. The release smoke compares the served version with the tag.

Release evidence

• Tag: v0.3.0
• Commit: 184fcfd771f995295a00f4b38febcd8a7eae9b3c
• Deploy: https://github.com/latere-ai/sermo/actions/runs/42068515758
• Origin: https://api.latere.ai
• Route: GET /v1/messaging/conversations answered 401 with a JSON error, so the origin routes the prefix to sermod
• Served version: v0.3.0, equal to the tag