cfctl v1.0.2

Unsigned release; integrity is by checksum. Verify against SHA256SUMS before use.

Changes

• Pre-push gate — cargo xtask verify now runs before every push and refuses on failure. Remote CI is intentionally absent, so nothing previously caught a gate that was never run (#78).
• Zone-scoped standing authority — cfctl keys policy create --zone pins one zone that children may bind alongside the account, so zone-scoped minting can run unattended. Child mints are now checked against the authority's allowed resources; that check did not previously exist, so an authority pinned to one account could admit a child bound elsewhere (#79, #80).
• Wrangler deploy cwd pinning — deploy and deployment-status subprocesses run from the reviewed config's directory. Wrangler resolves dotenv credentials relative to its working directory, so a plan reviewed against one config could otherwise publish with a token discovered from wherever cfctl was invoked (#77).
• keys mint --zone documented — the capability shipped in 1.0.1 but the runbook still described mint as account-only, so it went unused (#79).
• Repairs — two clippy::expect_used violations that had made main red, and identical oneOf schema branches being counted twice in the request builder (#76).

Standing authorities approved before this release keep their exact content hash and continue to validate; the zone bound is additive.

Verification

cargo xtask verify: exit 0 — fmt, clippy, full-workspace tests, cargo-deny, and full-history secret scan.

Live-proven against a real zone: zone-scoped mint through plan → approve → run, the minted token reading its pinned zone and refused on another, an unattended mint under a zone-bounded authority, and an out-of-bounds zone refused before mutation. All test credentials revoked with live verification.