v0.60.0

What's Changed

• Add --scopes flag to thv llm setup and config set by @reyortiz3 in #6964
• Add Redis storage for exchange grants by @jhrozek in #6981
• Wire configured delegate clients into the runner by @jhrozek in #6953
• Limit delegate token exchange to source clients by @jhrozek in #6988
• Fix flaky authz metrics assertions in OSV e2e by @jhrozek in #7002
• Order CreateSession test with channels, not sleeps by @jhrozek in #6994
• Give Chrome launch its own timeout in consent test by @jhrozek in #6993
• Add exchange refresh token client config by @jhrozek in #6989
• Keep RetrieveError in failed upstream refresh errors by @tgrunnagle in #6999
• Define exchange grant authorization details type by @jhrozek in #6990
• Answer /health from the health monitor's last check by @alex-feel in #7001
• Avoid vMCP rollouts on backend health changes by @Sanskarzz in #6975
• fix(operator): warn once per spec generation for embedding service by @xianshujun in #6969
• Let DCR upstreams choose the token endpoint auth method by @aron-muon in #6986
• Correct the /health staleness bound in the docs by @alex-feel in #7005
• Derive the delegate client signing algorithm by @jhrozek in #7006
• Issue refresh tokens through token exchange by @jhrozek in #7003
• Run policy gate tests serially to fix flaky runner test by @jhrozek in #7010
• Require a trust mode for private_key_jwt delegates by @jhrozek in #7004
• Update docker images by @renovate[bot] in #7016
• Move authserver JWK parsing to go-jose v4 by @jerm-dro in #7012
• Update go modules by @renovate[bot] in #7015
• Release v0.60.0 by @toolhive-release-app[bot] in #7013

Full Changelog: v0.59.0...v0.60.0