(engine) Prepare v0.27.0 release

[tcballard]

Outcome

Prepare AsDecided v0.27.0 as the first release of the completed MCP hardening and enterprise-deployability tranche.

Changes

• align the Rust workspace, decided, decided-mcp, lockfile, and official MCP Registry manifest on v0.27.0
• pin the public container quickstart to the v0.27.0 CLI image
• publish release notes covering hardened shared MCP serving, verifiable release artifacts, dependency policy, corrected public guidance, vulnerability handling, artifact trust, and the honest maintainer/continuity posture
• regenerate the locked Cargo third-party notice inventory for the release

Behavioural change

Non-loopback HTTP serving now requires the explicit --behind-proxy acknowledgement. Loopback serving is unchanged. The release notes and deployment-hardening guide call out the required proxy boundary.

Deliberate exclusion

distribution/pilot/pilot.app.yaml remains pinned to v0.26.2. It carries immutable published URLs and hashes and must not move to v0.27.0 until those release assets exist.

Validation

• cargo test --workspace --release --locked
• cargo clippy --workspace --release --locked --no-deps -- -D warnings
• cargo publish --dry-run --locked --allow-dirty -p asdecided-core
• package-boundary checks for decided and decided-mcp
• changelog, workspace, Registry version, and OCI identifier alignment
• native version output: decided 0.27.0
• live corpus: 451 valid, 0 invalid; 2,694 relationships, 0 issues
• Sentry: 27/27 eligible decisions constrained, 67 active rules, 0 violations
• git diff --check

After merge, publication remains a separate approval: create the v0.27.0 GitHub release, allow the gated release workflows to produce the verification pack, and verify those assets before downstream distribution moves.

Authored under my direction with Codex.