- Added PKI support for signing self‑issued certificates with a different signature algorithm and enforced a minimum cache size for the Transit backend, initializing it without restart.
- Fixed numerous bugs: agent panic with persistent cache, license deletion on DR secondary nodes, password policy generation in namespaces, quota deletion scope, identity alias rename collisions, Raft auto‑snapshot panic, premature static ...