chore(release): bump to 0.5.0

[pofallon]

Version bump only — no functional change. Step 1 of the two-step release: this lands through normal CI, then an annotated v0.5.0 tag on the merged commit triggers release.yml.

The bump

All four spots that must stay in sync:

	0.4.0 → 0.5.0
crates/deacon/Cargo.toml	✔ (the one release.yml validates the tag against)
crates/core/Cargo.toml	✔
root Cargo.toml, deacon-core dep	✔
Cargo.lock	✔ via cargo update -p deacon -p deacon-core

The diff is 10 lines and was asserted by pattern to contain only version lines — zero non-version changes.

Why 0.5.0

v0.4.0 was tagged 2026-08-16; main is 79 commits ahead. Conventional-commit tally over that range: 3 feat, 43 fix, 18 chore, 12 docs, and no ! breaking markers. On 0.x that is a minor bump.

Not 1.0: that is a deliberate milestone with its own roadmap (docs/ROADMAP_TO_1.0.md), not a mechanical consequence of this range.

What ships in it

The three features:

• feat(features): Feature content stages without BuildKit build contexts, so Features install on podman compose and under --buildkit never (feat(features): stage Feature content without BuildKit build contexts #725)
• feat(features): control manifests, mechanism implemented and default off (feat(features): support control manifests, without adopting the reference's #678)
• feat(parity): an env channel for the parity operation model (feat(parity): give an operation an env channel #679)

The fixes are dominated by two threads. Runtime honesty — build, Compose and every subcommand now run on the runtime they were told to use rather than a literal docker (#693, #697, #705, #709, #715), which also made the Podman lane report real coverage instead of fiction. And spec parity on up/build — the Feature-install stage becomes root and restores the image user (#687), _REMOTE_USER_HOME is read from the image's passwd DB (#696), a concurrent removal is waited out (#689), Windows identity-label normalization (#683), a deterministic compose Feature build (#702), and up now waits for the runtime's start event before touching the container it just started (#731).

Note on CHANGELOG.md — deliberately untouched

CHANGELOG.md has only [Unreleased] and [Pre-history] sections and has never been rolled for any release; its last edit (40d6fb6) is an ancestor of v0.4.0, so everything currently under [Unreleased] already shipped. Rolling that block into a ## [0.5.0] heading would misattribute v0.4.0-and-earlier changes to this release, so it is left as-is. GitHub release notes come from --generate-notes regardless.

That mismatch is worth fixing on its own — either roll the CHANGELOG per release, or drop it in favour of generated notes — but it is a separate decision and does not belong in a version bump.

Verification

Local, mirroring release.yml's verify job: cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, cargo test --workspace --lib. CI on this PR is the gate that counts.

After merge

Push an annotated tag on the merged commit:

git tag -a v0.5.0 -m "Release v0.5.0" && git push origin v0.5.0

release.yml validates the tag equals crates/deacon/Cargo.toml's version, re-runs verify (fmt/clippy/lib tests plus the three no-oracle parity lanes), then builds and publishes 8 targets with SHA256s, SBOMs and SLSA provenance.

🤖 Generated with Claude Code

https://claude.ai/code/session_013Hk5nFwExxSSAX1q62RUzy