v0.3.0 — Bi-Directional Webhooks & Registry Publishing

Highlights in v0.3.0

• Inbound Signed Slack Interactivity Webhook (POST /api/v1/webhooks/slack, #40):
  • Verifies X-Slack-Signature (v0=<hex>) and X-Slack-Request-Timestamp (±300s replay window) with UNS_SLACK_SIGNING_SECRET (constant-time hmac.compare_digest, 256 KB body limit, fail-closed 503 when unset).
  • Settles the canonical obligation_owner_id directly from Slack Block Kit Acknowledge (ack_<id>) and Dismiss (dismiss_<id>) buttons as actor slack:<team_id>:<user_id> and returns an in-place Block Kit message update (replace_original: true).
• Inbound Signed PagerDuty v3 Webhook & Bi-Directional Sync (POST /api/v1/webhooks/pagerduty, #41):
  • Verifies X-PagerDuty-Signature (v1=<hex>, supporting comma-separated rotation signatures) with UNS_PAGERDUTY_WEBHOOK_SECRET (fail-closed 503 when unset).
  • Settles uns-<dedup_key> / uns-<notification_id> obligations on incident.acknowledged / incident.resolved as pagerduty:<agent_id>, and propagates HTTP/Slack ACK and DISMISS outbound via Runtime.sync_pagerduty_incident() (PAGERDUTY_OUTBOUND_SYNC).
• Automated PyPI & Multi-Arch GHCR Release Publishing (.github/workflows/release.yml, #42):
  • Builds, smoke-tests, and attaches Python wheels/sdists to GitHub Releases, publishes multi-arch (linux/amd64, linux/arm64) images to ghcr.io/ylecoyote/uns with build provenance attestations, and publishes to PyPI via OIDC Trusted Publishing or PYPI_API_TOKEN.

Full Changelog: v0.2.0...v0.3.0