v0.6.0-alpha.4

What's Changed

• feat(images): Unify combined sidecar images, drop client-registration by @huang195 in #409
• refactor(cmd): split unified authbridge binary into 3 mode-specific binaries by @huang195 in #411
• refactor(authlib): proxy listeners session-event parity with extproc by @huang195 in #412
• fix: sweep post-#411 stale references (dead labels, dead images, dead docs) by @huang195 in #414
• fix(weather-demo): teach pick_log_container the proxy-sidecar container name by @huang195 in #420
• feat: Support AllowedAudiences for inbound JWT validation by @akram in #356
• feat(authbridge): Add ibac plugin + end-to-end demo by @huang195 in #421
• refactor(authlib): Extract LLM-judge boilerplate into authlib/llmclient by @huang195 in #422
• feat(abctl): Events-table PHASE rendering — hide skips, tree glyphs, lifecycle-only PHASE by @huang195 in #423
• feat(authbridge): mTLS between proxy-sidecar listeners via SPIRE X.509 SVIDs by @huang195 in #424
• fix(plugins): Drop mutex between token-exchange and token-broker by @huang195 in #404
• 🌱 refactor(authlib): drop unused actor-token-chaining plumbing by @huang195 in #429
• ✨ feat(forwardproxy): support HTTPS CONNECT as raw TCP passthrough by @huang195 in #430
• feat(authbridge): replace spiffe-helper with in-process go-spiffe SDK Provider by @huang195 in #432

Full Changelog: v0.5.0-rc.3...v0.6.0-alpha.4