v0.6.4

[0.6.4] - 2026-07-31

Added

• Continuous CodeQL, secret, dependency, npm, immutable-Action, and OpenSSF
  Scorecard security checks, plus scheduled Dependabot updates.
• Security ownership, disclosure targets, threat model, test matrix, incident
  response, and security-release documentation.
• Release SPDX SBOMs and GitHub provenance/SBOM attestations.
• Structured, body-free dashboard authentication failure events.
• Coverage-guided ClusterFuzzLite testing for proxy path, response-header, and
  correlation-ID trust boundaries.

Changed

• GitHub Actions are pinned to immutable commit SHAs.
• The ClusterFuzzLite builder image is pinned by digest and covered by weekly
  Dependabot updates.
• Dashboard responses now set no-referrer, nosniff, and frame-denial headers;
  dashboard session cookies use SameSite=Strict.
• Proxy paths reject encoded traversal and origin-confusing forms, malformed
  upstream response headers are dropped, and health responses no longer expose
  the configured upstream target.
• Releases are prepared through a protected pull request and finalized only
  after exact-SHA CI and security checks pass on the merged main commit.

Fixed

• The tag-triggered release workflow now grants its reusable security gate the
  pull-request write permission required by dependency-review's PR summary;
  GitHub can now validate the complete reusable-workflow graph on tag pushes.
• GitHub Release bodies are now generated deterministically from the matching
  version section in CHANGELOG.md.