thv 0.45.0 ڈاؤن لوڈ

## Changelog
* 7af27d38297e907c3b92ec4328cc4a8faf5c7195: Accept localhost dynamic-port loopback redirect_uris (#6215) (@jhrozek)
* 3c41b20eb5dc1b5a5d7aa5e71352e41e4cf77f78: Add CEL actor matching for trusted issuers (#6364) (@jhrozek)
* 1f545776d852e02d887d96032da93a3ccce47c4b: Add CLI identity-token acquisition for keyless skill push (#6390) (@samuv)
* 873543844d810d50207518f16290f88c24df968b: Add JWT-bearer assertion grant (#6391) (@jhrozek)
* 89dba0ce7ea0d4ec94179d6ccc2a3bff74d64e9c: Add Qoder IDE as a supported MCP client (#5870) (@haaaashimi)
* 95002a5608f41f4ed10ca3e4349f0f2a1772ac78: Add plugin lock-file sync (#6316) (@samuv)
* a8b3b791342af4f7296ebfe58a9e7cb0af3b43a2: Add plugin lock-file upgrade (#6317) (@samuv)
* c0285d3994e70deb8894e860d59271a80d42adf4: Add private_key_jwt DCR client authentication (#6427) (@jhrozek)
* 9ec0186d2782fe8a4ca80227bc148384c442547b: Allow loopback delegate clients (#6426) (@jhrozek)
* 92be1bffc37ce70b39dfcb55a4eacb5f1b740f43: Allow opt-in private endpoints for remote URLs (#6195) (@premctl)
* b66c49ad8ac124c0e3a79e6d994d7f1a6a984a62: Bump github.com/moby/go-archive from 0.2.0 to 0.3.0 (#6372) (@dependabot[bot])
* 69e922b1eb702a69a4b795b7e47f73a15e6c017f: Check first skill install against catalog-declared provenance (#6420) (@samuv)
* af6877172e51c22af51397e46f243bfc87de32ae: Deduplicate refreshes by storage row (#6361) (@jhrozek)
* e25de16cf9720b13cf0b400c861a2f6840e2763c: Enable keyless signing for CI skill pushes (#6402) (@samuv)
* 75ab44bb46a14845d93fd77cb7f53613731e5ac1: Expose the metrics migration switch to CLI and operator (#6371) (@amirejaz)
* b30ca2b0adceba1b3fa3781e0b672173d9db51db: Fix Windows unix socket URL round-trip (#6416) (@stantheman0128)
* 471e5f5bb8691064f5cbfc54f51371bcbc980d38: Fix atomic local state writes (#6350) (@jhrozek)
* 502cec3113436a58501e7aad8c0c96ca1e4ab680: Guard test backend ready channel against double close (#6363) (@jhrozek)
* 2320d7782413a42e73db0bcd61915fffaea10371: Honor all runtime_config fields over the workload API (#6214) (@jhrozek)
* 7c9c55ef09fae1bbdb49f4ccd1238ab10a27dd07: Honor configured vMCP backend timeouts (#6411) (@christensenjairus)
* ccabad62cb8150729c9435e4a0fb7bae5fc4abc7: Make the metrics endpoint move discoverable (#6369) (@amirejaz)
* 7f15a633caf7c2978925d908adde2d9a5c986cd5: Merge commit from fork (@jhrozek)
* 68dc1ba5c7ee9ead48aeae28409a3fac6b2f3422: Merge commit from fork (@jhrozek)
* 0b8acf26421ea48122add482c90c3c8d7a3dc8ea: Name the concrete removal trigger for the openpgp exclusion (#6286) (@samuv)
* 39a85c8675c034de4546ab37851bc15a8b6e5594: Pin golangci-lint to avoid nilness panic on main (#6393) (@samuv)
* d278b3377d2383088169823b7248040553901b7d: Plumb an identity token through skill push for keyless signing (#6385) (@samuv)
* 63d2522bbf1b35888ec89255c8ed3004c5a216fd: Point five stale doc paths at the moved files (#6388) (@melbinjp)
* 66586bc2bce8c78e24e9f53a0615291019f2ac31: Rate limiting observability (metrics and tracing) PR C (#6282) (@Sanskarzz)
* 789f2fb8e7c0cac6dd8bbcecd0484f71c169a8c8: Re-verify stored plugin signatures during sync (#6399) (@samuv)
* 34f276da4c0b186989c6bfd77e4673b17f0dd8bc: Record plugin installs in the project lock file (#6314) (@samuv)
* cc922a8b47652988ae4d057a957942385fc59270: Release v0.45.0 (#6436) (@toolhive-release-app[bot])
* 2b115568770aea3cea8f0e74d15906b99a14b2a0: Report a rejected stored credential as re-login required (#6389) (@aponcedeleonch)
* d077c74faa044f1d1a5e7c9469093f5c48397e55: Restore transport-port metrics behind a migration switch (#6370) (@amirejaz)
* dd0ea20010a42056d0a13fea4070addfd008cbc4: Resync session tools when backend health changes (#6196) (@premctl)
* fe39aecface7e7579583bf03a713d58272193080: Reuse tool embeddings across sessions (#5996) (@TANTIOPE)
* b6aa0471e93228f74f6b9a64a5e075fb2c0d92a7: Serialize skill sync and upgrade under the lock (#6352) (@samuv)
* 7b72d4b6f71a14c60899d6c732f4a55214d176ca: Serve Prometheus metrics on a separate diagnostics listener (#6296) (@amirejaz)
* 1751f2fc1a54a70f182173fa96c33a1d49f8d13d: Serve vMCP metrics on a separate diagnostics listener (#6368) (@amirejaz)
* 7f9a098196e1c72ecc24ebdaa1e21f4a4d0102b7: Store plugin sigstore bundles, carry git signature (#6396) (@samuv)
* 39d0d14cd280b7bcad87f5163e4044f1eebbf982: Strip leading UTF-8 BOM before filtering list responses (#6304) (@Yanhaoxi)
* cb0359de61ed0ef6fd476e1ef07811c6d976e16e: Sweep leaked workloads after local e2e runs (#6367) (@jhrozek)
* e1061cbb8ea77d2dfeee673aee8f6a3aa6837eec: Switch skill artifact signing to toolhive-core's signer (#6383) (@samuv)
* 406fd8d808cb5b3c5c0b98927dc6a07cd86ced61: Update anthropics/claude-code-action action to v1.0.195 (#6338) (@renovate[bot])
* e1533a994c442c67df5935f1c3101c78c8c5a02b: Update anthropics/claude-code-action action to v1.0.205 (#6412) (@renovate[bot])
* 72ffb454c730eb5477f40c8be973e1047a39e5ea: Update module github.com/stacklok/toolhive-catalog to v0.20260817.0 (#6375) (@renovate[bot])
* f35ce22451731296d8368c6dd496f25dc80bf873: Update module github.com/stacklok/toolhive-catalog to v0.20260824.0 (#6422) (@renovate[bot])
* 811b75b0d29b6853e95072ddb7aeae8397e0309d: Use conformant Accept in dual-era e2e (#6123) (@kocaemre)
* 9a9686c1cc40345e91e057ff612661c0b40cf415: Verify plugin signatures at install time (#6397) (@samuv)
* 54f52fbceb05c4610f0a2067db86a844a3af6b12: feat(operator): allow pod scheduling on the proxy Deployment via resourceOverrides (#6183) (@talshechanovitz)
* 7eb3f34f9fa6f47d965e7d09f6aeb1d72664c451: fix(authz): commit recorded status before flushing in ResponseFilteri… (#6335) (@Yanhaoxi)
* 96bdd55afe79ee7a97d96acf5bb18c162c40bd63: fix(operator): add MCPGroup Proxies printer column (#6376) (@RaviTharuma)
* 2962bf67bf9de0d4ca9a8312b0632ddf03c3dee5: fix(operator): honor kubectl rollout restart on ToolHive workloads (#6378) (@RaviTharuma)
* b48013eac5e555588f4814002e496801196c7a87: fix(operator): recreate deleted MCPServer StatefulSet (#6379) (@RaviTharuma)