v0.44.0

What's Changed

• Push skills unsigned until keyless signing lands by @samuv in #6334
• Support actor_token in RFC 8693 token exchange by @jhrozek in #6331
• Guard OAuth token and DCR endpoints against SSRF by @jhrozek in #6351
• fix(auth): require audience when introspecting via Google tokeninfo by @SashaMIT in #6236
• Fix stale version comment on codespell action pin by @samuv in #6360
• Harden external may_act delegation by @jhrozek in #6353
• Use an absolute thv path in the Claude Desktop helper shim by @jerm-dro in #6354
• Release v0.44.0 by @toolhive-release-app[bot] in #6365

Full Changelog: v0.43.0...v0.44.0