v2.1.0 — Standalone server mode + DNS/SDK-compat fidelity

Release Notes — v2.1.0

✨ Features

Standalone server mode — cloudemu serve

Run cloudemu as a real server and point any SDK, in any language, at it over the network — not just the in-process test double.

• All three providers on stable ports: AWS 4566, Azure 4568 (HTTPS), GCP 4569, plus a shared Kubernetes data-plane
• Self-signed TLS for Azure, request logging, and graceful shutdown
• Prints the endpoints (and writes them as JSON) so an app can target the whole emulated cloud at once
• New DriversFrom / NewFromProvider helpers build a running server from a provider in one line
• Purely additive — the in-process New(Drivers{…}) API is unchanged

🔧 Enhancements

DNS fidelity

• Record and zone listing are now deterministic (were random order)
• Zones are scoped to their resource group / project on both list and lookup
• Azure CreateOrUpdate applies the request's tags instead of echoing the old zone
• Long TXT values are split into valid ≤255-byte chunks
• ChangeResourceRecordSets is all-or-nothing — a bad batch leaves the zone untouched
• GCP managed-zone names must be unique within a project

SDK-compat listing & updates

• Logging, event bus, cache, and notification gained scoped listing, CreateOrUpdate-applies-updates, and request-derived Azure ARM ids (no more hardcoded rg-default)

Azure Service Bus namespaces

• Namespaces now keep state: tags persist, listing is scoped to the resource group, and a wrong-group Get/Delete no longer touches another group's namespace

Real-cloud semantics audit

• Typed errors, fake-clock time handling, and map/slice copying at store boundaries brought in line with the real services

Technical Details

Standalone server (#224)

• feat(cmd): standalone server mode — cloudemu serve — cmd/cloudemu serve subcommand: per-provider ports, in-memory self-signed TLS, shared kubernetes.APIServer, request-logging middleware, SIGINT/SIGTERM shutdown, endpoints bundle.
• server/{aws,azure,gcp}: DriversFrom + NewFromProvider; providers expose their identity fields.
• Out-of-process test drives real AWS (HTTP) and Azure (self-signed HTTPS) SDK clients against the binary. Docs: docs/standalone-server.md.

DNS fidelity (#253)

• Deterministic ListRecords / weighted GetRecord via SortedValues().
• Scope on zones; scoped ListZones; new UpdateZone; scoped resolveZoneID; upsert no longer hijacks a same-named zone in another group.
• TXT values chunked to ≤255 bytes; ChangeResourceRecordSets validated before apply; GCP managed-zone name uniqueness per project.

SDK-compat slices (#259)

• services/scope (Scope + wildcard Matches); each driver's List* takes a scope filter, providers store the creating scope, new Update* methods, Azure ids derived from the request path.
• Real-SDK regressions per domain: scoped listing, upsert-applies-updates, request-derived id.

Service Bus (#278) & audit (#274)

• fix(servicebus): in-memory namespace store — CreateOrUpdate persists tags/SKU/scope; Get/List/Delete scope-checked.
• Deep audit: typed-error alignment, clock injection over wall-clock reads, maps.Clone/copy at store boundaries.