v0.3.0-beta

Added

• 13 Datadog fetchers (new category): Cloud SIEM detection rules & signals, SIEM
  operational configuration, log pipelines / indexes / archives, host & container
  inventory, agent check results, the APM service catalog, and incident records with
  timelines. Credential setup in fetchers/datadog/README.md.
• paramify scripts sync — push each fetcher's entry script (fetcher.py /
  fetcher.sh) to Paramify and CONNECT it to that fetcher's evidence set, so the
  tenant records how each piece of evidence is generated. A provisioning step
  separate from paramify upload: it reconciles the tenant to the repo GitOps-style
  (marker-keyed identity in the script description, fetcher.yaml version as the
  update signal, a sha256 drift guard). Scoped to a manifest by default — it
  provisions scripts only for the fetchers you collect, mirroring how upload is
  run-scoped — with --all to push the whole catalog, plus --dry-run / --force /
  --reassociate / --json. Backed by the uploaders/paramify_scripts/ uploader.
  Only SCRIPT associations are automated; control / solution-capability / validator
  linkage stays Paramify-side.
• docs/uploader_design.md — a dedicated uploader design
  doc covering both built uploaders and the shared evidence-set identity model, and
  a README section + docs-table entries pointing to it.

Changed

• TUI Paramify tab redesigned into stacked evidence upload and scripts sync
  panels. Scripts sync gained a Preview action that runs a read-only dry-run and
  surfaces the per-fetcher plan (create / update / drift / noop) in a table — flagging
  which drifted scripts --force would push — and syncs the active manifest's fetchers.

Fixed

• TUI: page keyboard shortcuts (ctrl+r / ctrl+u / ctrl+s) now fire regardless of
  which control is focused, and default focus lands in the active pane on mount, on tab
  switches (mouse clicks included), and after escape — previously they worked only
  right after a number-key tab switch.
• TUI: the Add fetchers picker no longer drops a category once all its fetchers are in
  the manifest; already-added fetchers show greyed-out and non-selectable, so a
  fully-added category (e.g. datadog) stays visible.
• TUI: the Paramify action row (Preview / Sync Scripts / force / reassociate) now uses
  uniform control sizes instead of content-sized widths and mismatched heights.