- Update Loki operand to v2.8.3 and add extensive zone‑aware scheduling features, custom tenant topology, and default pod anti‑affinity/topology‑spread constraints for all components
- Add security enhancements including mTLS authentication for tenants, OIDC IssuerCAPath fix, runtime default seccomp profile, and configurable HTTP server timeouts
- Introduce namespace/tenantId labels on RecordingRules, pod disruption budgets for ruler, ingestion and query paths, and per‑stream rate‑limit & burst settings