RegistryStack v0.8.3

RegistryStack v0.8.3

RegistryStack v0.8.3 is a security and release-trust patch release after
v0.8.2.

Scope

• Keeps the stack release in the public registrystack/registry-stack
  monorepo.
• Adds release-level SLSA provenance generation for tag-triggered GitHub
  Releases, allowing the release workflow to publish and verify
  *.intoto.jsonl provenance for non-signature release assets.
• Fixes cargo-deny advisory checks and removes unmaintained JSON-LD test
  dependencies.
• Triages CodeQL code scanning findings in scripts, demos, and generated docs
  helpers.
• Replaces RS256 RSA verification support with AWS-LC-backed crypto in the
  platform crypto layer.
• Keeps Crosswalk as the tested pinned product input.
• Keeps Registry Atlas and the eSignet Relay authenticator held as lab-only
  external inputs.

Release Gates

The source release is expected to pass:

• release manifest validation;
• import-map audit;
• Rust workspace checks;
• Lab monorepo source proof;
• full docs checks, archive builds, SEO, and built-link validation.

The tag-driven release workflow publishes final binaries, GHCR images, image
digests, SBOMs, Grype reports, keyless cosign signatures, and release-level SLSA
provenance. Hosted/public announcement remains a separate gate after
hosted-state proof.