Atomic state and hardened API defaults
State writes become atomic, API defaults get locked down, and Go 1.25 is standardized.
A quiet reliability release:
- Atomic JSON state writes — container state files can no longer be left
half-written if the process dies mid-save.
- Isolated tests — the test suite runs against
CARDINAL_DATA_DIRinstead
of a shared real home directory.
- Secured API defaults — Bearer authentication enabled by default, with
image metadata stored safely.
- Standardized toolchain — Go 1.25 across CI and release tooling.
Nothing flashy, but it's the kind of hardening that keeps a container runtime
dependable in production.