Changelog

• fbe710b chore(deps): bump github.com/mark3labs/mcp-go from 0.58.0 to 1.0.0 (#3747)
• c2dbab1 chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 (#3746)
• 74269b7 chore(deps): bump helm.sh/helm/v3 from 3.20.2 to 3.21.4 (#3748)
• dc42aab chore: remove unused 1.png (#3772)
• f95fd72 ci: bump Codium-ai/pr-agent from 0.43.0 to 0.44.0 (#3749)
• 9b6f31a ci: bump Codium-ai/pr-agent from 0.44.0 to 0.45.0 (#3765)
• 6e57aff ci: bump docker/setup-qemu-action from 4.2.0 to 4.3.0 (#3750)
• 50c7742 ci: bump github.com/armosec/armoapi-go from 0.0.757 to 0.0.760 (#3766)
• 7ab40bc ci: bump github.com/quay/claircore from 1.5.35 to 1.5.54 (#3764)
• 94dbf45 ci: bump go.opentelemetry.io/otel/exporters/otlp/otlptrace (#3762)
• f55f4a5 ci: bump google.golang.org/api from 0.280.0 to 0.297.0 (#3761)
• 78c2987 ci: bump helm/kind-action from 1.14.0 to 1.15.0 (#3751)
• 24af8fa ci: bump k8s.io/apimachinery from 0.36.2 to 0.37.0 (#3709)
• 0b3d016 feat(fleet): add cross-cluster control matrix and fleet report types (#3774)
• 299509d feat(list): add --framework and --search filters to list controls (#3623) (#3718)
• 6a97de1 feat(mcpserver): introduce structured machine-readable error responses (#3776)
• 10d4c96 feat(rules): add host-users-root-workload-v1 rule prototype (#3754)
• 153e9d9 feat(rules): detect Azure AKS Workload Identity in provider-iam-assumption-v1 (#3724)
• ddbd0ac feat(scan): extend --kube-contexts fleet mode to framework/control/workload (#3440)
• 483a570 fix(diff): do not print usage when --fail-on-new fails (#3756)
• a696bda fix(exposure): model GRPCRoute exposure paths with v1beta1 fallback (#3728)
• 4a949f3 fix(fix): warn when --output-dir is ignored for file-based reports (#3767)
• 33c1475 fix(git): use hex encoding for hashRepoURL instead of raw bytes (#3720)
• 194d7ab fix(httphandler): gracefully shut down HTTP server and scan worker (#3769)
• e7b3dfb fix(mcpserver): return explicit error for unsupported resource_kind in scan_resource_slice (#3740)
• 031cd40 fix(opaprocessor): fix AllResources data race in celParamObjectFinder (#3787)
• 8850cc5 fix(policyhandler): route mixed Framework/Control scan identifiers by their own kind (#3768)
• 5324639 fix(printer): generalize evidence redaction beyond Secret-kind-only (#3752)
• d3c0138 fix(printer): honor --show-evidence in control and resource views (#3775)
• 7817ea5 fix(printer): route SARIF, GitLab-SAST, HTML, and CSV fix-path values through --show-secrets redaction (#3759)
• 023d128 fix(rbacgraph): order escalation results instead of reading map order (#3739)
• 75e9d0b fix(resourcehandler): retrieve single workload via Get instead of List (#3722)
• 20053d7 fix(resultshandling): rebuild namespace rollup after severity filtering (#3726)
• 13849cb fix(scan): normalize kind case and support short names in workload scan (#3730)
• 074bf30 fix: do not print scan usage when --severity-threshold fails (#3716) (#3717)
• f8cb183 test(cel): check the vendored bundle against the digests pinned in the Makefile (#3742) Released by GoReleaser.