docs: v1.1 upgrade guide and release doc updates (#1003)

* docs: add v1.1 upgrade guide

Covers new features (configurable webhook header names, SQS IAM role
auth, attempt operator events), behavior changes (retry task DLQ,
response body cap, per-destination alert suppression, topic
normalization, RabbitMQ redial), and the DISABLE_DEFAULT_*_HEADER
deprecations.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: warn wildcard opevent subscribers about per-attempt volume; cross-link attempt events

OPERATION_EVENTS_TOPICS=* now includes attempt.success/attempt.failed,
which fire per delivery attempt. Swap the wildcard example for an
explicit topic list, promote the volume note to a warning callout, flag
the upgrade impact in the v1.1 guide, and link operator attempt events
from the delivery attempts section.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: SQS IAM actions; redis-debug checks retry DLQ keys

Document the SQS actions the Outpost principal needs (runtime set, plus
CreateQueue/GetQueueAttributes under auto-provisioning) in configuration
and byo-mqs docs. Add the deliverymq-retry-dlq keys to the redis-debug
RSMQ key analysis and its documented sample output.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: thank first-time contributors in v1.1 guide; drop partial-creds detail

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: drop alert suppression section from v1.1 guide (bug fix, release-notes material)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: expand thanks wording

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: drop topic normalization section from v1.1 guide (bug fix)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: drop RabbitMQ redial section from v1.1 guide (bug fix)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

chore: 🐝 Update SDK - Generate OUTPOST-TS 1.5.0 (#1009)

* `outpost.configuration.getManagedConfig()`:  `response` **Changed** (Breaking ⚠️)
* `outpost.configuration.updateManagedConfig()`: 
  *  `request` **Changed** (Breaking ⚠️)
  *  `response` **Changed** (Breaking ⚠️)

Co-authored-by: speakeasybot <bot@speakeasyapi.dev>

chore: 🐝 Update SDK - Generate OUTPOST-PYTHON 1.5.0 (#1008)

* `outpost.configuration.get_managed_config()`:  `response` **Changed** (Breaking ⚠️)
* `outpost.configuration.update_managed_config()`: 
  *  `request` **Changed** (Breaking ⚠️)
  *  `response` **Changed** (Breaking ⚠️)

Co-authored-by: speakeasybot <bot@speakeasyapi.dev>

chore: 🐝 Update SDK - Generate OUTPOST-GO 1.5.0 (#1006)

* `Outpost.Configuration.GetManagedConfig()`:  `response` **Changed** (Breaking ⚠️)
* `Outpost.Configuration.UpdateManagedConfig()`: 
  *  `request.Request` **Changed** (Breaking ⚠️)
  *  `response` **Changed** (Breaking ⚠️)

Co-authored-by: speakeasybot <bot@speakeasyapi.dev>

fix(deps): bump Go toolchain to 1.26.4 to patch stdlib CVEs (#983)

* fix(deps): bump Go toolchain to 1.26.4 to patch stdlib CVEs

The v1.0.6 release binary is compiled with Go 1.26.0 stdlib, which a
security scanner flags for 29 stdlib vulnerabilities (issue #979).
Because GOTOOLCHAIN=auto honors the go.mod directive, bumping it to
1.26.4 forces the release build to compile against the patched stdlib.

Fixes #979

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: install Go 1.26.4 directly in release and unit-test workflows

Match the go.mod directive so CI builds/tests on the patched toolchain
instead of relying on GOTOOLCHAIN auto-download.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(alert): default/disable semantics for consecutive-failure & exha…

…usted-retries alerts (#964)

* feat(alert): add Settings + enable gates for consecutive/exhausted alerts

Introduce alert.Settings (the resolved, operational alert config) plus two
monitor gates: WithConsecutiveFailureEnabled and WithExhaustedRetriesEnabled.

Both default to true, so behavior is unchanged until a caller opts out. When
consecutive-failure alerting is gated off the monitor neither tracks failures
nor auto-disables; when exhausted-retries is gated off it never emits, even
with retries enabled. Extracts the consecutive-failure path into a helper to
keep the replay/ordering semantics identical on the enabled path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(config): resolve alert config to alert.Settings with unset/empty/value rule

AlertConfig.ConsecutiveFailureCount and ExhaustedRetriesWindowSeconds become
*string so the parse layer can tell three states apart: unset uses the default
(100 / 3600), an empty string disables that alert dimension, and any other value
must parse to a non-negative integer.

AlertConfig.ToConfig resolves the raw values into the operational alert.Settings
(domain-owned, so nothing downstream imports config). Validate rejects malformed
values at startup. builder wires the resolved gates into the monitor and only
builds the exhausted-retries suppression window when enabled with a positive
window (0 = alert on every exhaustion).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(config): document alert default/disable behavior in config reference

Update the Alerts section of the self-hosting config reference for the new
unset/empty/value rule: ALERT_CONSECUTIVE_FAILURE_COUNT defaults to 100 (empty
disables), and document the previously-undocumented
ALERT_EXHAUSTED_RETRIES_WINDOW_SECONDS (default 3600, empty disables, 0 = no
suppression).

Also correct stale entries: drop the removed ALERT_CALLBACK_URL, fix the
ALERT_AUTO_DISABLE_DESTINATION default (false, not true), and fix the YAML
example key (alert, not alerts).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(openapi): describe alert behavior in ManagedConfig

Document the unset/empty/value behavior for ALERT_CONSECUTIVE_FAILURE_COUNT,
ALERT_EXHAUSTED_RETRIES_WINDOW_SECONDS and ALERT_AUTO_DISABLE_DESTINATION in the
ManagedConfig schema. Descriptions only — the properties are already typed as
string. SDKs are regenerated from this schema at release time.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(config): make empty-string alert disable work on the env-var surface

The *string representation had two problems found by manual QA:
1. caarlos0/env ignores a present-but-empty env var, so `ALERT_..._COUNT=`
   resolved to the default instead of disabling — the empty=off rule only
   worked via YAML, not env vars (the primary surface for the cloud product).
2. caarlos0/env crashes ("expected a pointer to a Struct") on any non-nil
   *string it walks, so setting these in a YAML config file would crash startup
   (env.Parse runs after the YAML load).

Replace *string with an OptionalString value type that implements both
TextUnmarshaler (bound by caarlos0/env as a scalar — no crash) and
yaml.Unmarshaler (so `key: ""` expresses the empty/off state). The one case
caarlos0/env cannot surface — a present-but-empty env var — is handled
explicitly via OSInterface.LookupEnv, which also gives env precedence over YAML.

Net: unset -> default, empty -> disabled, value -> value, identically on both
env and YAML, with env > yaml. Adds a full parse-path test covering the matrix
and precedence.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(e2e): use OptionalString for ConsecutiveFailureCount in regression test

Missed call site when migrating AlertConfig fields to OptionalString;
the raw int assignment broke the cmd/e2e build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(destregistry): treat event format errors as failed deliveries, no…

…t DLQ (#957)

* fix(destregistry): treat event format errors as failed deliveries, not DLQ

A Format/key-template failure (e.g. an S3 key_template referencing a field
absent from the event) returned a nil delivery, which the registry turned into
a nil attempt and the deliverymq handler classified as a PreDeliveryError →
nack → Pub/Sub DLQ. The failure was never logged, invisible to the customer,
and paged us instead of surfacing as an actionable delivery error.

Add destregistry.NewFormatErrorDelivery, returning a non-nil failed Delivery
plus an ErrDestinationPublishAttempt, so the registry records a failed attempt,
acks the message, and retries via the scheduler. The customer-facing response
is a generic message; the raw Go error stays on the error for logs/telemetry
and is not persisted on the attempt.

Apply it across all providers with a Format step: s3, sqs, azure_servicebus,
gcp_pubsub, webhook, webhook_standard (previously `return nil, err`) and
kinesis, kafka (previously nil-delivery ErrDestinationPublishAttempt).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(e2e): regression for format error delivered as failed attempt, not DLQ

Standalone e2e test reproducing the production incident: an aws_s3 destination
whose key_template references a field missing from the event. Asserts the fixed
behavior end to end — nothing is written to S3, each delivery is recorded as a
failed attempt carrying the format error, and retries run on the normal schedule
and exhaust their budget rather than being nacked/dead-lettered.

Verified as a real guard: reverting the destawss3 fix makes this test fail
(0 attempts logged, message dead-lettered) instead of recording 3 attempts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* refactor(destregistry): rename NewFormatErrorDelivery to NewFormatError

The helper returns the (*Delivery, error) pair a publisher returns on a format
failure, not just a delivery — name it accordingly. Behavior unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(e2e): trim format-error regression test comment

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

chore: 🐝 Update SDK - Generate OUTPOST-TS 1.4.1 (#963)

* `outpost.configuration.getManagedConfig()`:  `response` **Changed** (Breaking ⚠️)
* `outpost.configuration.updateManagedConfig()`: 
  *  `request` **Changed** (Breaking ⚠️)
  *  `response` **Changed** (Breaking ⚠️)

Co-authored-by: speakeasybot <bot@speakeasyapi.dev>

chore: 🐝 Update SDK - Generate OUTPOST-PYTHON 1.4.1 (#962)

* `outpost.configuration.get_managed_config()`:  `response` **Changed** (Breaking ⚠️)
* `outpost.configuration.update_managed_config()`: 
  *  `request` **Changed** (Breaking ⚠️)
  *  `response` **Changed** (Breaking ⚠️)

Co-authored-by: speakeasybot <bot@speakeasyapi.dev>

chore: 🐝 Update SDK - Generate OUTPOST-GO 1.4.1 (#960)

* `Outpost.Configuration.GetManagedConfig()`:  `response` **Changed** (Breaking ⚠️)
* `Outpost.Configuration.UpdateManagedConfig()`: 
  *  `request.Request` **Changed** (Breaking ⚠️)
  *  `response` **Changed** (Breaking ⚠️)

Co-authored-by: speakeasybot <bot@speakeasyapi.dev>