v0.72.0

What's Changed

• chore(deps): bump docker/login-action from 4.5.1 to 4.6.0 by @dependabot[bot] in #1557
• chore(deps): bump actions/attest from 4.2.0 to 4.2.1 by @dependabot[bot] in #1559
• chore(deps): bump aws-config from 1.9.0 to 1.10.1 by @dependabot[bot] in #1558
• chore(deps): bump sigstore-verify from 0.9.0 to 0.11.0 by @dependabot[bot] in #1560
• chore(deps): bump uuid from 1.23.5 to 1.24.0 by @dependabot[bot] in #1561
• chore(deps): bump tokio from 1.52.3 to 1.53.1 by @dependabot[bot] in #1562
• docs(cli): fix curl command for fetching latest version by @carver in #1569
• chore(deps): bump prettyplease from 0.2.37 to 0.3.0 by @dependabot[bot] in #1563
• fix(why): fail on unresolvable network policy instead of degrading by @fyockm in #1554
• fix(profile): preserve user profile source context by @RomainMuller in #1571
• fix(exec): update PWD with --workdir by @kurtisc in #1564
• ci: add COPR build validation on release PRs by @SequeI in #1572
• fix: allow config files for Claude by @kurtisc in #1547
• ci(issue-triage): remove automatic triage label on new issues by @lukehinds in #1575
• ci: add doc tests to CI and ship musl release artifact by @SequeI in #1578
• fix(deps): update event-listener 5.4.1 → 5.4.2 (RUSTSEC-2026-0221) by @SequeI in #1581
• feat(profiles): remove openclaw and swival as built-in profiles by @SequeI in #1582
• docs(profiles): clarify profiles dir is read-only by default, unless explicitly allowed via --allow by @SequeI in #1587
• fix(proxy): fail closed on non-granted endpoint approvals in TLS intercept by @lukehinds in #1585
• feat(why): report explicit deny paths from sandbox policy by @lukehinds in #1556
• feat(sandbox): add static seccomp network baseline on linux by @lukehinds in #1590
• chore: release v0.72.0 by @SequeI in #1593

New Contributors

• @carver made their first contribution in #1569
• @fyockm made their first contribution in #1554

Full Changelog: v0.71.0...v0.72.0