Please cut a new release including PR #186 (Pod Security restricted defaults)

[kutekahuna]

Summary

Would it be possible to cut a new tagged release (e.g. 0.0.6) or republish the main / latest images to include the changes from #186?

Why

PR #186 ("adds Kubernetes Pod Security Standards restricted defaults to RustFS workloads", merged 2026-07-19 in commit e9d0a51) is required to run Tenant pods in Kubernetes namespaces that enforce the
restricted Pod Security Standard.

Without it, the StatefulSet the operator generates from a Tenant CR is rejected by PSA with:

pods "-pool-0-0" is forbidden: violates PodSecurity "restricted:latest":
allowPrivilegeEscalation != false (container "rustfs" must set securityContext.allowPrivilegeEscalation=false),
unrestricted capabilities (container "rustfs" must set securityContext.capabilities.drop=["ALL"]),
runAsNonRoot != true (pod or container "rustfs" must set securityContext.runAsNonRoot=true),
seccompProfile (pod or container "rustfs" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

This blocks deployment of rustfs-operator in any cluster where restricted is the default PSA profile (a common hardening baseline, e.g. many CNCF-graduated distributions and platforms).

Current state

The most recent published image on all three registries — Docker Hub (rustfs/operator), GitHub Container Registry (ghcr.io/rustfs/operator), and Quay (quay.io/rustfs/operator) — predates PR #186:

┌────────┬───────────────────────┬────────────────┐
│ Tag │ Registry timestamp │ Includes #186? │
├────────┼───────────────────────┼────────────────┤
│ 0.0.5 │ ~2026-07-09 │ No │
├────────┼───────────────────────┼────────────────┤
│ latest │ ~2026-07-09 (= 0.0.5) │ No │
├────────┼───────────────────────┼────────────────┤
│ main │ ~2026-06 │ No │
└────────┴───────────────────────┴────────────────┘

Because .github/workflows/docker.yml only triggers on release: [published] and workflow_dispatch, no image has been built from main since #186 was merged.

Requested action

Either of the following would unblock downstream consumers:

1. Preferred: cut a new tagged release (e.g. 0.0.6) that includes fix(operator): support restricted pod security #186. This publishes to all three registries and updates :latest.
2. Interim: run workflow_dispatch on docker.yml to republish the main image from current HEAD.