Stability checkpoint v0.5.3 — smoke:full-stack allow_failure (DinD bind-mount limitation) - fix(ci): smoke:full-stack allow_failure + dated TODO (DinD bind-mount issue) (156d2c1) v0.5.1 + v0.5.2 had smoke:full-stack fail on a Docker-in-Docker bind-mount limitation : the macbook-local runner shares the host's docker daemon, so paths under /builds/... in the CI workspace aren't visible to the daemon. The dnsmasq.conf + tinyproxy.conf bind mounts fail before any of the test logic runs. Pragmatic short-term : `allow_failure: true` with a dated TODO (2026-05-15) per CLAUDE.md global short-term-bridge exception. The local `bin/test-full-stack.sh` still works (verified 2/2 PASS in v0.5.0 commit message + multiple local re-runs). Tag pipeline goes from 31/32 (one hard failure) to 32/32 (1 allowed- failure annotation) — green release object, signed images, cosign verifies, registry tags all in place. CI : - ✅ Main pipeline green - ✅ MR #20 merged - ✅ Tag pipeline expected 32/32 (1 allow_failure) - v0.5.4 — bake docker/dnsmasq.conf + docker/tinyproxy.conf into the sidecar images at build time so no bind mount is needed. Then drop the allow_failure here. Single-commit ticket. - v0.6.0 — JWT validation + OIDC discovery + TTL cache + bearer auth on the IdP URL