Lataa thv 0.22.0

## Changelog
* 109815bf98fc0035dfdb966d270a63ff2dbb2e02: Account for embedded auth env in deployment drift checks (#4878) (@JAORMX)
* c17cb40c7b0a3ce9db386e014579e4fe618f3519: Add --system flag to secret list and delete commands (#4910) (@amirejaz)
* 50044f3d3c7f60a315f51a547c3968580f19c78b: Add AdditionalAuthorizationParams to upstream OAuth configs (#4862) (@jhrozek)
* eb7ddef53d337c0e4f5fbfa1df48b71b105feb85: Add EmbeddingServiceManager for TEI container lifecycle (#4912) (@yrobla)
* 108f6fa9c81b7cd82c42a15d150e8321f5230421: Add e2e tests for thv vmcp CLI (#4941) (@yrobla)
* cfd835cd0e89f562ae969c2a4fd41d375f3a8e02: Add name attribute alias on Resource entities (#4907) (@jhrozek)
* ee988f35b6ff04bf2fb08f11b235b7ec6072d70b: Add pkg/vmcp/cli/init.go for vMCP config scaffolding (#4903) (@yrobla)
* ee823d89c430bb6babb4071dadc494a73414bac9: Add policy_stopped workload status and enforce policy gate on restart (#4857) (@reyortiz3)
* 829c4bd07d69dbf1f0b57b862d5b8cb0d6c4fa1e: Add registry-aware workload creation (#4872) (@rdimitrov)
* e6c453a861e853763c32ffb07d5748e7ecb9f64a: Add thv vmcp init subcommand (#4939) (@yrobla)
* e4bfbfe3fba091f0fbd504a8e8475cf7987f7768: Add thv vmcp serve and thv vmcp validate subcommands (#4900) (@yrobla)
* cb37b8ba0d5f95934e1e1e5b843ab3549cdff094: Add unit and integration tests for Cedar group-based authorization (#4964) (@jhrozek)
* b8b76ccec4ddef04c480f50cd5b1ec6fa3d197ef: Add unit tests for pkg/vmcp/cli serve and validate logic (#4898) (@yrobla)
* 8223becaa603c3426d2410dfba95a0e6b8d0e1bc: Add zero-config quick mode for thv vmcp serve (#4913) (@yrobla)
* f5e0dbd221aeb1e7bb6593bf11b7d8b86d918a95: Bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 (#4921) (@dependabot[bot])
* 03f502501dc205a90c3cdd1785da2f890a86d7b9: Bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (#4906) (@dependabot[bot])
* c2b41861fedbee0c701584300decf2d7baf6c9c4: Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 (#4793) (@dependabot[bot])
* 74335226cae32b50cd1b17fae8fdc90eda54e1b4: Detect JSON-RPC application errors in proxy audit middleware (#4709) (@gmogmzGithub)
* 14fe9b69caeea39accc18ae154aa929e450c02ce: Document 502 Bad Gateway failure for installSkill in OpenAPI spec (#4960) (@samuv)
* 8504427fab44e7f1e3afa6161d656c911767d816: Document category-based redis ACLs (#4946) (@tgrunnagle)
* c1292c406eaa653209d75bb8690a50b0cefe59cf: Extend group extraction with dual-claim and dot-notation support (#4911) (@jhrozek)
* 5342824025e06a54e156a5c34b1899cc2b78bcee: Extract vMCP serve/validate logic into pkg/vmcp/cli/ (#4891) (@yrobla)
* b2f6717888668b3e4ec00ac38ea4254149be63b4: Finish defaultTEIImage rename in embedding_manager_test.go (#4957) (@JAORMX)
* 0e5e576e2d599bdb5a97823cde874c5e224dae9d: Fix partialFailureMode validator to accept CRD enum values (#4865) (@jhrozek)
* c331aa4996cbc5f93d2dc6142c80c6b385e1a772: Fix skill install for qualified namespace/name references and missing parent directory (#4841) (@samuv)
* e516be42b5fdbc5b6169c8745865de5600ded3a5: Hide thv vmcp command from CLI help (#4967) (@JAORMX)
* ab2a8210744af07c5e888ce0ce6d81f5bd58c280: Only install skills for clients detected on the system (#4899) (@samuv)
* ee39caff9af461177af138c0edc90b9f09b8e2e8: Release v0.22.0 (#4968) (@stacklokbot)
* dfd794da4ecbaa0fdb02e48e7701f081dc0782ad: Remove empty parent directories on skill uninstall (#4895) (@samuv)
* 34e877d58744a04ad555af1bc09dcbd71568a2b3: Replace groups parameter with variadic parents on entity factory (#4901) (@jhrozek)
* ccf439d3b161281719fcd1062ba9396b823258c0: Return 502 Bad Gateway when OCI skill pull fails (#4956) (@samuv)
* 7a9d65909b1b942d7358bcd70312cb8b78cc1d04: Split skillsvc into per-concern files (#4947) (@samuv)
* f6cdfc29a679258a2294ae3e445da548d2dfb2f0: Thread image verification mode through workload service (#4966) (@rdimitrov)
* 213638793dc7b745b441d04e5f073afd007cd77e: Treat unauthenticated backends as routable in vMCP health (#4866) (@lorr1)
* 4ebcf3bb3716bc3d13246ee39d002d319431c628: Update README (#4915) (@danbarr)
* ea4cfbce034cf92c143d4328fe6509ed84e101d2: Update actions/cache digest to 27d5ce7 (#4924) (@renovate[bot])
* ee01104b557b0e13c723f9335926373d36507835: Update alpine Docker tag to v3.23.4 (#4927) (@renovate[bot])
* 9f021b9d88fb15d79fce254542b68548b1738351: Update anthropics/claude-code-action digest to 5d5c10a (#4925) (@renovate[bot])
* e0c11d6eaf05a9222830e2b3dd23af7ee0ac5237: Update github/codeql-action digest to 95e58e9 (#4926) (@renovate[bot])
* dce0ac7bf778af1db61ac5c91dd00cab5a0edd1a: Update module github.com/stacklok/toolhive-catalog to v0.20260417.0 (#4909) (@renovate[bot])
* 06d27460c47dedcde85251a43cf33f20bc25a72a: Update module github.com/stacklok/toolhive-catalog to v0.20260421.0 (#4932) (@renovate[bot])
* 98894b8dd3ae0280659a5df9bfa9d332efe8027b: Update operator architecture docs for authServerRef (#4780) (@tgrunnagle)
* b437352a2a1136d3bb423e4788294104684dea91: Upgrade default go builder image to golang:1.26-alpine (#4955) (@JAORMX)
* b4f391b2632e6c60c2831ea0c5d3f3be6de121a5: Upgrade default npx builder image to node:24-alpine (#4954) (@JAORMX)
* f4724762bc85e88cc378e54e207fa4ec95410c2f: Upgrade default uvx builder image to python:3.14-slim (#4953) (@JAORMX)
* d96922d77459ca93804bb22a5e79e83179529898: Validate audience matches resourceUrl for embedded auth server (#4904) (@tgrunnagle)
* d687eb7e7fe0e46595957464bdc844066404eff6: Wire optimizer flags into thv vmcp serve (#4940) (@yrobla)
* 92897a6d42994f14a8df4d9608f44e4b89c36f2c: embedding_manager: address Copilot review findings from #4912 (#4938) (@yrobla)
* c334edf5f692dc6bdd254dcd8fc855a97fd8b2ca: vmcp: stop the TEI manager on Start failure and apply image default in Serve (#4948) (@SAY-5)