Tags: qntx/ks

chore: bump version to 0.5.0 and relax TOTP secret-length validation

- Bump workspace version from 0.4.0 to 0.5.0
- Switch TOTP parsing to `from_url_unchecked()` and `new_unchecked()` to accept real-world 80/96-bit secrets (Google, etc.) instead of enforcing RFC 6238's 128-bit provisioning minimum
- Fix `ks run` env variable naming: use full logical path (`AWS_ACCESS_KEY`) instead of stripping prefix, preventing collisions when multiple prefixes share suffixes
- Pin `.age-recipients` to LF line endings

refactor(hardening): split lock_memory into explicit stages with gran…

…ular SAFETY comments

Move rlimit struct initialization and getrlimit/setrlimit calls outside the single unsafe block to clarify each FFI boundary. Add dedicated SAFETY comments for getrlimit (writes local struct), setrlimit (reads local struct), and mlockall (scalar flag with conditional MCL_FUTURE logic). No functional change—just clearer separation of unsafe operations.

dev

ci(workflows): update publish and release configs for two-crate archi…

…tecture

- Add ks-cli to publish.yml packages list
- Switch release.yml to release-rust.yml workflow with bin/package params
- Constrain release tags to semantic versioning pattern (v*.*.*)
- Bump workspace version to 0.2.0
- Update dependencies: toml 0.8→1, keyring 3→4, rand 0.8→0.10
- Add keyring-core 1 workspace dependency
- Register native keyring store in ks-cli main() for session cache
- Replace keyring::Entry with keyring_core::{Entry, Error}
- Migrate