v0.46.3

Verifying this release

Each binary is signed keylessly with cosign (Sigstore,
GitHub OIDC — no long-lived keys). Verify a download against its bundle:

cosign verify-blob \
  --bundle sail-linux-amd64.cosign.bundle \
  --certificate-identity-regexp '^https://github.com/standardapplied/sail/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  sail-linux-amd64

The .sha256 files remain for a plain checksum check.

What's Changed

• test: the release ITs hop from 0.46.2 as well as from older releases by @udaychandra in #284
• One rule per type, and main decides every pushed revision with it by @udaychandra in #283
• docs: the sync contract, each invariant with the tests that prove it by @udaychandra in #285
• sync: a box's runs carry the handle main knows it by, and a live run is never rewritten by @udaychandra in #286
• sync: quiescent boxes hold exactly what main holds by @udaychandra in #287
• sync: every offer settles, and no round fails for something that will arrive by @udaychandra in #288

Full Changelog: v0.46.2...v0.46.3