(engine) Prepare v0.27.0 release

[tcballard]

Outcome

Prepare AsDecided v0.27.0 as the first release of the completed MCP hardening and enterprise-deployability tranche.

Changes

• align the Rust workspace, decided, decided-mcp, lockfile, and official MCP Registry manifest on v0.27.0
• pin the public container quickstart to the v0.27.0 CLI image
• publish release notes covering hardened shared MCP serving, verifiable release artifacts, dependency policy, corrected public guidance, vulnerability handling, artifact trust, and the honest maintainer/continuity posture
• regenerate the locked Cargo third-party notice inventory for the release

Behavioural change

Non-loopback HTTP serving now requires the explicit --behind-proxy acknowledgement. Loopback serving is unchanged. The release notes and deployment-hardening guide call out the required proxy boundary.

Deliberate exclusion

distribution/pilot/pilot.app.yaml remains pinned to v0.26.2. It carries immutable published URLs and hashes and must not move to v0.27.0 until those release assets exist.

Validation

• cargo test --workspace --release --locked
• cargo clippy --workspace --release --locked --no-deps -- -D warnings
• cargo publish --dry-run --locked --allow-dirty -p asdecided-core
• package-boundary checks for decided and decided-mcp
• changelog, workspace, Registry version, and OCI identifier alignment
• native version output: decided 0.27.0
• live corpus: 451 valid, 0 invalid; 2,694 relationships, 0 issues
• Sentry: 27/27 eligible decisions constrained, 67 active rules, 0 violations
• git diff --check

After merge, publication remains a separate approval: create the v0.27.0 GitHub release, allow the gated release workflows to produce the verification pack, and verify those assets before downstream distribution moves.

Authored under my direction with Codex.

[tcballard]

Release hygiene refresh completed on 2026-08-08.

• rebuilt this release commit directly on current main (90f054a), leaving the branch one commit ahead and zero behind
• corrected the proposed v0.27.0 changelog date to 2026-08-08
• retained the deliberate distribution/pilot/pilot.app.yaml v0.26.2 pin until immutable v0.27.0 assets exist
• reconciled and closed completed hardening issues (engine) Make multi-file rename application transactional #408 and (mcp) Enforce response budgets as hard limits #411, then closed epic Epic: MCP hardening — close the swarm-review findings #418 with every exit criterion checked
• confirmed the diff remains limited to the intended eight release files (142 additions, 26 deletions)
• reran local structural checks: exact version/dependency/Registry/OCI alignment, changelog contract, JSON parsing, shell syntax, and git diff --check
• reran GitHub validation on head 9907789: PR Checks run 31270569757 passed and rust-spike run 31270569779 passed, including Linux contract/live-corpus invariants, strict Clippy, cargo-deny, and Windows/macOS native runtime smoke

The PR remains draft and unmerged. Publication is still a separate approval after merge.