v1.76.6

sluis v1.76.6

Image	ghcr.io/truvity/sluis/sluis:1.76.6
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.76.6
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.76.6
Chart	oci://ghcr.io/truvity/charts/sluis:1.76.6
TypeScript	@truvity/sluis@1.76.6 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.76.6

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.76.6_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.76.6_linux_arm64.zip,
sluis-slack_1.76.6_linux_arm64.zip, sluis-google_1.76.6_linux_arm64.zip,
sluis-cloudflare_1.76.6_linux_arm64.zip and
sluis-backup_1.76.6_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• 91c88d1: fix(modcall): neutralise caller-supplied values in the refusal log (CodeQL #111) (@excavador)

Other

• cc15c3d: ci: run CI as six recipe groups, with release-lint and flake reruns (@excavador)