v0.3.1

03ddc7d chore(release): cut CHANGELOG v0.3.1
ec28b69 fix: CI govulncheck pin, hook exit/label mismatch, requires_gdt, audit fixes

v0.3.0

180a969 test(rename): make TestRollback case-insensitive-FS safe
edfea19 Merge branch 'improve/toolchain-ci-parity'
00c071f docs: release v0.3.0 (Go 1.25 note, release verification)
31ec682 docs: changelog for unreleased CI/toolchain parity
9b6bb8e ci(release): checksums + keyless cosign signing; bump actions
743086f ci: add lint, govulncheck, gofmt check across OS matrix; dependabot
2a1787b build: bump Go toolchain to 1.25
896cb56 refactor(refs): use strings.ReplaceAll (staticcheck QF1004)
1b416fa style: gofmt internal/cmd/init.go and internal/policy/policy.go

v0.2.0

69d9924 feat: phase 1 & 2 upgrade — metadata, policy thresholds, safety, profiles
1dfaf07 docs: update changelog for v0.2.0
fcecc9e feat: --profile flag for lint and GDT_ASSETS_PROFILE for hooks
3cbe8ba feat: policy profile system with override resolution
0b3e17c feat: conservative refs repair from rename manifests
7bede62 feat: rollback manifests and collision detection for rename
37b79a8 feat: rename operation plan with collision detection
d705f17 feat: add category field to diagnostics for grouping
702b42f feat: enhanced doctor with lint summary, ref check, and type breakdown
7dbd3b9 feat: power-of-two validation for images with UI exemption
07bc25a feat: policy-driven max size thresholds for all analyzers
69a8107 feat: scanner populates image dimensions during scan
f5bddc3 feat: add image metadata extraction via stdlib DecodeConfig
b3e5090 feat: introduce structured exit codes (0-4)

v0.1.0

feat: initial release with CI, cross-platform releases, and shell com…