v0.4.4 — undici security and container workflow fix

[0.4.4] - 2026-06-19

Security

• Bump transitive undici 6.26.0 → 6.27.0; addresses CVE-2026-12151 (high), CVE-2026-9679 (moderate), CVE-2026-11525 and CVE-2026-6733 (low) (#94)

Fixed

• Container publish workflow: workflow_dispatch on branch refs runs scan-only (Trivy SARIF, CRITICAL gate) without SBOM path or Docker metadata failures (#93)
• GHCR push, provenance attestation, and release SBOM restricted to refs/tags/v*.*.* semver refs; semver-shaped branch names can no longer trigger a publish

---

Deploy

• Container image: ghcr.io/solarssk/admitto:0.4.4 (rolling :0.4)
• Migrations apply automatically on container start (with pre-migration backup when pending). No manual migrate deploy.

Full changelog