[BRAVO68WEB]

Summary

Minor release 0.23.0. Pins `ghcr.io/envsync-cloud/minikms:sha-60e2feb` (minikms#11+#12: cert-proof sessions, fail-closed mTLS).

Program / phase

• N/A

No-piggyback checklist

• Does not make product A depend on product B via spawn, re-export, or rename-only API
• Shared code is a library (kernel/domain/ui), not a second entrypoint of another product
• If this creates or provisions an organization, it matches the channel matrix (§1.1a)
• Self-host web session never gains a new org-create path
• New enterprise API/UI modules are registered for the enterprise package path (not only silently inside core forever) — note follow-up phase if interim
• OSS deploy changes do not call into `deploy-cli` / enterprise deploy sources

Tests

• Mock / unit (if API)
• E2E or pack smoke (if behavior/deploy)
• N/A docs-only

Image pin + package version lockstep.

Risk / rollout

Self-host upgrades pull the new miniKMS image. TLS-enabled stacks must set `MINIKMS_TLS_CA_FILE` and API client certs.