vouchfx v1.0.0-rc.5

What's Changed

• docs(examples): add a runnable mutual-TLS example by @tomas-rampas in #391
• feat: load an encrypted client key for mutual TLS via security.clientKeyPassword by @tomas-rampas in #406
• feat(runtime): derive the security carve-out once from a SecurityAssurance record by @tomas-rampas in #414
• fix(cli,runtime): let a document refused for its contents still declare security by @tomas-rampas in #416
• fix(security): match a security declaration to its confirmation by identity, not by target name by @tomas-rampas in #418
• docs: an imagePullPolicy under a dependency is refused, not silently ignored by @tomas-rampas in #422
• feat(orchestration): apply a managed dependency's env: to its container by @tomas-rampas in #434
• feat(orchestration): refuse a dependency env: entry naming an engine-set variable (T4+T5) by @tomas-rampas in #435
• fix(deps): patch three high-severity advisories in the VSCode extension lockfile by @tomas-rampas in #440
• fix(tests): sweep the Windows CA store copy each certificate bed leaves behind by @tomas-rampas in #441
• build(deps): Bump the codeql-action group across 1 directory with 2 updates by @dependabot[bot] in #403
• build(deps): Bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #404
• docs(ci): stop naming a pinned action's version in prose beside the pin by @tomas-rampas in #442

Full Changelog: v1.0.0-rc.4...v1.0.0-rc.5