v0.7.0

What's Changed

Added

• pgroles generate --suggest-profiles can refactor flat brownfield manifests into deterministic reusable profiles, using live database inventory before wildcard collapse so suggestions do not broaden privileges.
• New pgroles_core::suggest API and pgroles_inspect::fetch_object_inventory export for callers building their own suggestion workflows.

Fixed

• Large operator plan SQL previews are now stored as gzip-compressed ConfigMap binaryData when needed, avoiding Kubernetes ConfigMap size failures and reconcile retry loops.
• Status-less PostgresPolicyPlan resources and orphaned plan SQL ConfigMaps are cleaned up defensively before and after reconcile.
• Plan storage ordering and cleanup behavior are covered by the TLA+ model.

Changed

• Breaking library API change: PolicyManifest.profiles is now a BTreeMap<String, Profile> for deterministic YAML serialization. CLI and operator users are unaffected.

Validation

• cargo fmt --all -- --check
• SQLX_OFFLINE=true cargo clippy --all-targets --all-features -- -D warnings
• cargo test --workspace
• scripts/check-crd-drift.sh
• git diff --check

What's Changed

• feat(generate): add --suggest-profiles to refactor flat manifest into reusable profiles by @hardbyte in #96
• Fix plan SQL storage and orphan cleanup by @hardbyte in #100
• Address plan storage review follow-ups by @hardbyte in #101

Full Changelog: v0.6.0...v0.7.0