thv 0.9.4 ڈاؤن لوڈ

## Changelog
* f1772c6ebbf6b162681fbaa64a74bda9955532e7: Add AWS STS auth type to MCPExternalAuthConfig CRD (#3816) (@jhrozek)
* 2f5d58a7ef5afc4ea5e18c7684eeae334134cc44: Add AWS STS token exchange for OIDC-to-AWS credential conversion (#3659) (@jhrozek)
* 4556e303572cdddb918d1a5735d41af18b1bbace: Add OTEL telemetry documentation and migration guide (#3784) (@ChrisJBurns)
* 9305d9e18dc3566a9ff52b5dadd8aeb7a228ad7b: Add Operator CRD Types for Auth Server Redis Storage (#3793) (@tgrunnagle)
* c8f2254630425ecc2645c91282f2d8efd14fe6df: Add Redis Storage Backend for Auth Server (#3639) (@tgrunnagle)
* 0273b4ffacd82a16a373b4ce62ea19456c78ac37: Add Redis Storage Integration Tests with Testcontainers (#3785) (@tgrunnagle)
* 02496a204589e75e59e7f50f40c16abef89830cc: Add SQLite FTS5-backed ToolStore for optimizer search (#3786) (@aponcedeleonch)
* f77d75f397f88f54baff87a889551310ccc194b4: Add SQLite SkillStore implementation and factory wiring (#3801) (@JAORMX)
* 3ec4fcb5e4bbf084a76d62b3a695f1c6916ea973: Add SQLite foundation with connection, PRAGMAs, and goose migrations (#3771) (@JAORMX)
* 319666906739339185d19d4592ba3ffae906a2ca: Add SigV4 signing middleware for AWS STS token exchange (#3730) (@jhrozek)
* 3420ec511ac7383e227843db7d0789902e3d30aa: Add String() method to telemetry Config to redact OTLP credentials (#3782) (@ChrisJBurns)
* d07ac209987db1f3c01be09422b3053a5394a46e: Add ToolStore interface and refactor DummyOptimizer to use it (#3749) (@aponcedeleonch)
* cf2c338d6eeab0f92a8d130614dd60e0586e04fc: Add UseLegacyAttributes flag to telemetry config (#3729) (@ChrisJBurns)
* 076127745e05a5cae34bedb07eb6a9dbeba528f7: Add W3C Trace Context propagation via MCP _meta (#3682) (@ChrisJBurns)
* 5e2fa08fa6ea2fd73b2d4a1a7571d7211c17fe5e: Add `mcp.protocol.version`, client operation duration, span target naming, and client span kind (#3757) (@ChrisJBurns)
* 9f2849973bf60d6169e3658a1ffe48aabc36e5fd: Add `mcp.server.operation.duration` metric per OTEL MCP semantic conventions (#3752) (@ChrisJBurns)
* 6f75e1a316715470ce5ea184c72f15740207d185: Add basic SkillService implementation and API handlers (#3804) (@JAORMX)
* 2454caba932bc6a03c666fa6dfdaf344e3e2a305: Add client skill metadata for skill path resolution (#3712) (@JAORMX)
* 9206aa486240250a0b468a5410b107972a8c3383: Add default resource limits to VirtualMCPServer vmcp container (#3689) (@jerm-dro)
* c9ed08eee493003bbe756164f9240948969b23ac: Add explicit histogram bucket boundaries to duration metrics (#3787) (@ChrisJBurns)
* 493e16bdbb406724563661535428124e4e56cd38: Add external resource integration tests for MCPRemoteProxy (#3685) (@ChrisJBurns)
* 9405bac41096c7206818a9112f10c2a3e8529304: Add network/client span attributes and fix span status per OTEL semconv (#3750) (@ChrisJBurns)
* d06891df647ddbcb7623c57ccd8fb1e56738d15d: Add offline_access to default scopes and fix PRM scope discovery (#3794) (@jhrozek)
* 053650af0939436b323c07d20b1c461a1dc5d269: Add rfc8707 resource parameter refresh token (#3713) (@rodrigo1208)
* a6ffa1a96c1adef63712ed85a53d2ae39709f53b: Add scope parameter to WWW-Authenticate header per RFC 6750 (#3795) (@jhrozek)
* d380531238ea08a71cc0d463fc18c8fda635eb7b: Add shared skill types (#3833) (@blkt)
* f3c7ec2d9a0ae967609cbce15ad97461a55696b0: Add storage interfaces, errors, noop store, and factory (#3768) (@JAORMX)
* 090696484f78fb345b394fee47160999a652c042: Add test quality guidelines to CLAUDE.md (#3807) (@aponcedeleonch)
* 4a19119dbde90cc4916836e74217eecd434fdbe8: Add token metrics to DummyOptimizer find_tool responses (#3821) (@aponcedeleonch)
* 7c695644f40a847702554a57d8c0cc2c51522962: Address miscellanious post-merge review feedback for AWS STS role mapper (#3708) (@jhrozek)
* e5cf4f63c58254a900644b83875d2bcd08947730: Align skills REST API contract with RESTful conventions (#3818) (@JAORMX)
* 15eaa3c92a1031c50ec24dedfdc572caec44a23e: Align vMCP client telemetry with OTEL MCP semantic conventions (#3775) (@ChrisJBurns)
* a2eb40e95c7f65c88c32c8e208aac35df8508775: Create GitHub release even when tag already exists (#3717) (@ChrisJBurns)
* 9630ae37d69945c18855c08191ae7385095718d2: Enable OIDC provider support in the embedded auth server (#3720) (@jhrozek)
* 60f23f5878305f5f2a7b2b66b62a59600db381a4: Extract trace context from MCP _meta for distributed tracing (#3763) (@ChrisJBurns)
* cee60fd49eec45ea74c2c336df1b68a97dc7658e: Fix SSE gauge leak, config bool handling, and metric error logging (#3756) (@ChrisJBurns)
* 8f61745359dc1fd4e64460d02d316b8013e0ce61: Fix kind load failures with Docker 29+ containerd image store (#3815) (@jhrozek)
* fd5472ca5e2c20ea5f1bee2b0ca3f7edb6a64255: Fix staticcheck SA5011 nil pointer lint failures (#3769) (@JAORMX)
* 06963519acc95a6b3076776baded1e26e9a5e03d: Fix tool counter per-request creation, omitempty config, and streamable-http version (#3761) (@ChrisJBurns)
* 471f878e8031e5007e42ddd40c50c3254235705f: Fix wrong API group in MCPExternalAuthConfig webhook marker (#3798) (@jhrozek)
* b9af6fc8a7fcf56a13708551cdcebdc213b4ce24: Gate legacy span attributes behind UseLegacyAttributes flag (#3747) (@ChrisJBurns)
* 4f0d3f89fee4894d7500c9950aafda964a8168bf: Make role mapping Priority in AWS STS config optional with *int (#3715) (@jhrozek)
* f3e6b8a7fff5a5ffdc35edb3478717ae7c51bf8c: Release v0.9.3 (#3718) (@stacklokbot)
* d41c8f2f8c391909f8fae251ea752172a4859eed: Release v0.9.4 (#3836) (@stacklokbot)
* e15caa0dda07a12c6391e7cf3169c75675c33a22: Rename span attributes to MCP OTEL semantic conventions (#3748) (@ChrisJBurns)
* 8537bc7f722525cebec799e408489b18a0c7638c: Resolve OTel serviceVersion at runtime instead of persisting it (#3789) (@ChrisJBurns)
* 5afa2989813520adeb82b1c7803ce04f9f9958ff: Return scope in DCR response per RFC 7591 Section 3.2.1 (#3797) (@jhrozek)
* 0d3f450a89c134ec57e34fe717d4c59c87d60138: Revert "Release v0.9.3" (#3716) (@rdimitrov)
* d343edf05f2e54fdb17bf5b4312de5721cd626df: Set audience on DCR clients for refresh token support (#3796) (@jhrozek)
* b9e26a36b796d64afd7e9e70fbf6dfe9d20f2d0c: Update anthropics/claude-code-action digest to 23ed4cb (#3737) (@renovate[bot])
* e4ad6734d3abcaf53e0e8ea7c99ddc00fca5e357: Update anthropics/claude-code-action digest to 68cfeea (#3830) (@renovate[bot])
* 1b6366547bc0ad44599168b9226cd037e499b406: Update anthropics/claude-code-action digest to ea36d6a (#3809) (@renovate[bot])
* 0855b10e194205a38822dda4246e74a961692dac: Update anthropics/claude-code-action digest to f669191 (#3800) (@renovate[bot])
* 3fed7499582643f7a034ca1f5c5390d5ae606713: Update aquasecurity/trivy-action action to v0.34.0 (#3813) (@renovate[bot])
* 2c00fae8d271069462037d3d3171af365b19332e: Update aws-sdk-go-v2 monorepo (#3719) (@renovate[bot])
* 59232d8a1dd8ce6b94e2f34163d0e890bc5c93d0: Update docker/build-push-action action to v6.19.0 (#3774) (@renovate[bot])
* 5c275ade400cacdb085421367a88b2551189b081: Update docker/build-push-action action to v6.19.1 (#3781) (@renovate[bot])
* 6ddb19d5b490c4bcebefcf21c725cf4335977d8d: Update docker/build-push-action action to v6.19.2 (#3802) (@renovate[bot])
* c65aeea492a79e15c780dc5ec080c4fc3f6143c0: Update golang.org/x/exp/jsonrpc2 digest to 2735e65 (#3728) (@renovate[bot])
* 6b4273966d2e401dbb6464923876308869639851: Update golang.org/x/exp/jsonrpc2 digest to 81e46e3 (#3810) (@renovate[bot])
* 0bd2efc0b670332d202c0caa6fa6ba24060b2ba1: Update k8s.io/utils digest to b8788ab (#3753) (@renovate[bot])
* 0ec1cc59be4178d436ef0e1251dd9a395dab7b7d: Update k8s.io/utils digest to b8788ab (#3780) (@renovate[bot])
* 0e8f9c030f89d07e9bee21350a7f144b44c34ce1: Update kindest/node Docker tag to v1.35.1 (#3826) (@renovate[bot])
* 18daa166d5f8a4932f00339fddbba795a663b28d: Update kubernetes packages to v0.35.1 (#3767) (@renovate[bot])
* 11869b18fefa6ced09af1402fa123d3c39668506: Update module github.com/cedar-policy/cedar-go to v1.5.1 (#3751) (@renovate[bot])
* b01b63e19f0302c537d868aa3f81749fc811809f: Update module github.com/cedar-policy/cedar-go to v1.5.2 (#3799) (@renovate[bot])
* a52bf27ccaff89f63b1cabca3761c89fb68726af: Update module github.com/mark3labs/mcp-go to v0.44.0 (#3828) (@renovate[bot])
* 7753c47eeec676fccb70815a6ca2c36ba4ed1b1d: Update module golang.org/x/crypto to v0.48.0 (#3722) (@renovate[bot])
* a5e287d125b6ab958d381a613820c5bc4b543916: Update module golang.org/x/mod to v0.33.0 (#3723) (@renovate[bot])
* 468c29f316c5603f2f3ebecbbdd58740905411eb: Update registry from toolhive-registry release v2026.02.10 (#3736) (@github-actions[bot])
* ee0e10fd8cf25114c5e337c64a2b0f72417000bc: Update registry from toolhive-registry release v2026.02.12 (#3766) (@github-actions[bot])
* 1bf49e52d85160a76706d0597a626a8d7d6535f5: Update registry from toolhive-registry release v2026.02.13 (#3817) (@github-actions[bot])
* 98075c4e37c74a70042a1d1e8f0c95c2bf0ad68a: Update registry from toolhive-registry release v2026.02.14 (#3825) (@github-actions[bot])
* 97345373b6a429d02485161f15bb40e1c488c3fb: Update registry from toolhive-registry release v2026.02.15 (#3827) (@github-actions[bot])
* e40df2546b94787902bc9037ce1d6443017318fd: Update registry from toolhive-registry release v2026.02.16 (#3829) (@github-actions[bot])
* 1469e9b3ce90032ea5d5cb21f3466a23f115697c: Use CEL variable binding instead of string interpolation for claim matching (#3709) (@jhrozek)
* 76bce0377b03e4013b9d22d79343a9e423caccd1: Use workload name as default OTel service name (#3788) (@ChrisJBurns)
* 6f3557606066543bcdac14850597a149cc225855: Wire AWS STS middleware into the runner middleware chain (#3770) (@jhrozek)
* 16c1d90ab9223cc224458af25b91f7a9552dc787: adds claude skill for setting up otel in kind (#3725) (@ChrisJBurns)
* 84bec9a388e896f9a4cd8062c2d666b775595df7: chore(vMCP): Add tool call labels to vMCP telemetry metrics (#3687) (@jerm-dro)
* 788126d6718e401db9166b1c397bbd1d0a5af17f: vMCP does not follow standard MCP Streamable HTTP behavior (#3624) (@juancarlosm)