v0.9.2

bound request bodies and slow clients across orchestrator and host agents (#119) (70387d8)
clear dependabot and CodeQL security alerts (#88) (bac883a)
contain qemu image paths to prevent cross-vm rootfs reads (#117) (c91dd27)
patch reachable go vulnerabilities and gate ci on govulncheck (#118) (f0d43ca)
preserve secure session cookies behind tls proxies and fail closed on partial tls config (#120) (5a24a58)
remove the duplicate govulncheck job that made ci.yml unparseable (#124) (4ad3d7e)
restrict host mutations and harden provider egress (#121) (6d96522)
security: patch reachable go vulns and verify release asset checksums (#110) (7198070)
stop gatekeeper blocking the brew-installed cli on macos (#123) (f399b9e)
verify goreleaser checksums before installing release assets (#122) (48a3062)