agent-bom v0.94.0

What's Changed

• fix(docs): repair out-of-tree links breaking strict mkdocs build by @msaad00 in #3632
• fix(cli): unified terminal UX — sections, deduped CIS, quiet cloud by @msaad00 in #3633
• fix(cloud): Key Vault CIS false-PASS + least-privilege deep-scan grants by @msaad00 in #3636
• fix(cloud): scan Lambda deployment packages + deep-scan pre-tagged container images by @msaad00 in #3634
• fix(cloud): Lambda discovery on by default (no --include-lambda) by @msaad00 in #3635
• ci(docs): gate PRs on mkdocs build --strict by @msaad00 in #3638
• feat(output): scale-ready tabbed + paginated HTML report by @msaad00 in #3637
• feat(ui): Storybook harness for large dashboard components by @msaad00 in #3640
• feat(enrich): mature the multi-provider LLM enrichment harness by @msaad00 in #3639
• fix(scanners): correct OSV fixed_version resolution by @msaad00 in #3644
• fix(output): SARIF/json finding-count parity + --reproducible timestamps + /dev/null exit by @msaad00 in #3645
• Part of #1469 (Phase 0: hardware-backed device identity) by @msaad00 in #3646
• chore: logo + branding consistency pass by @msaad00 in #3647
• Part of #3499 (Iceberg catalog export) by @msaad00 in #3648
• Part of #3499 (ClickHouse findings-ingest) by @msaad00 in #3650
• perf(db): fix cvss filesort + O(table) origin count on hub current reads by @msaad00 in #3654
• Part of #3192 (drift-as-UI lens) by @msaad00 in #3649
• Part of #1969 (phase 1: strict mypy for models + core API) by @msaad00 in #3655
• Closes #3499 tail (Swift bare-call precision) by @msaad00 in #3656
• perf(db): generic RANGE-partition maintenance + retention rollover by @msaad00 in #3657
• fix(rbac): resolve NO_AUTH_ROLE from env at call time (kills release-blocker CI flake) by @msaad00 in #3660
• docs: canonical how-it-works + deployment matrix + editions page by @msaad00 in #3668
• fix(api): consistent empty-scan response shape across MCP and HTTP surfaces (CI flake) by @msaad00 in #3663
• Closes #1522 (split output/html.py) by @msaad00 in #3661
• perf(graph): bounded snapshot-stats, rollup orphans, deep-offset cap (Part of #3664) by @msaad00 in #3669
• refactor(cli): unify scan verb, tier flags behind --help-all, dedup formats by @msaad00 in #3672
• fix(cis): fail-closed on per-resource permission denial across ~25 checks (Closes #3679) by @msaad00 in #3691
• fix(mcp): gate ingest_external_scan as a destructive write (Closes #3681) by @msaad00 in #3692
• fix(ingest): chunked reconcile_absent + pip-visible ai-enrich security floors by @msaad00 in #3693
• fix(cis): ERROR on partial permission denial (strict GRC coverage) by @msaad00 in #3695
• fix(malicious): synthesize vuln-less malicious findings end-to-end by @msaad00 in #3694
• fix(audit): genesis chain verification and git-SHA range false-positive by @msaad00 in #3696
• feat(runtime): shield fail-closed defaults, cred redact, SSRF guard by @msaad00 in #3699
• feat(audit): signed chain checkpoint detects tail truncation by @msaad00 in #3700
• feat(identity): SCIM patch fixes, audit RBAC, session logout hardening by @msaad00 in #3701
• chore(dev): 'make preflight' to catch OpenAPI/schema drift before push by @msaad00 in #3702
• docs: consolidate duplicate doc clusters (stage 1 of #3703) by @msaad00 in #3704
• feat(identity): auto-bind SCIM subject on API key issuance by @msaad00 in #3705
• feat(platform): DB-aware /readyz and firewall reload fail-closed by @msaad00 in #3707
• feat(cloud,runtime): full coverage and shield hardening by @msaad00 in #3706
• fix(config): warn on unparseable env bool/int/float values by @msaad00 in #3711
• feat(output): add SARIF partialFingerprints for GitHub dedup by @msaad00 in #3712
• docs(config): canonical env aliases and regenerated ENV_VARS (#3677) by @msaad00 in #3713
• refactor(api): centralize /v1 mount on shared API router (#3666) by @msaad00 in #3715
• chore(tests): group cloud tests under tests/cloud/ (#3703) by @msaad00 in #3716
• fix(security): resolve CodeQL sensitive export and exception alerts by @msaad00 in #3717
• chore(tests): group API tests under tests/api/ (#3703) by @msaad00 in #3718
• fix(security): clear CodeQL alerts and finalize MCP catalog drift (#3675) by @msaad00 in #3719
• docs(deploy): add README for raw Kubernetes manifests by @andres-linero in #3720
• docs(deploy): add README for Snowflake deployment assets by @andres-linero in #3721
• chore(release): prepare 0.94.0 by @msaad00 in #3722
• fix(accuracy): git-SHA advisory false positives + malicious packages missing from CSV by @msaad00 in #3723
• docs(release): fold #3723 into 0.94.0 changelog by @msaad00 in #3724

Full Changelog: v0.93.5...v0.94.0