v0.9.0

The CLI gains full user and role management, on top of a large CI, documentation, and test-hardening pass.

Highlights

• bamf users and bamf roles — the CLI now covers user and custom-role CRUD (list/get/create/update/delete) against the existing API, so admins can script access management instead of using the web UI. Roles take a YAML-or-JSON --from-file; all commands support --json.
• CI is faster and more resilient — the Go cross-compile check is sharded per platform (~330s → ~95s wall-clock), and all GHCR logins/pushes now retry through a composite action so a transient registry blip no longer fails a build or release.
• A documentation site + a strict docs gate — a MkDocs site with mkdocs build --strict in CI fails on any broken internal link or orphaned page, plus new operator docs (production checklist, incident runbooks, security hardening, disaster recovery).
• Declared invariants are now executable guards — CI enforces the content-hygiene rule, no-sync-work-in-async-handlers (Semgrep), the Helm-values ↔ config model contract, and dependency pins that previously drifted silently. A documented vulnerability-suppression process backs the scanners.

Features

• bamf users and bamf roles admin commands (#223, #224) — closes #124.

Status

Alpha — infrastructure hardening plus the first CLI-driven admin surface. No breaking changes.

Full Changelog: v0.8.6...v0.9.0