Stability checkpoint v0.5.4 — bake sidecar configs (close v0.5.3 allow_failure)

- feat(security): bake sidecar configs into images, drop smoke:full-stack allow_failure (ADR-0035) (4aaf069)

v0.5.3 shipped allow_failure:true on smoke:full-stack with a dated TODO
(remove by 2026-05-15). v0.5.4 closes that TODO 15 days early.

Root cause was a Docker-in-Docker bind-mount limitation : sidecars
bind-mounted docker/dnsmasq.conf + tinyproxy.conf from the repo,
which broke under DinD because /builds/... CI workspace paths aren't
visible to the host daemon.

Fix : COPY the configs into the sidecar images at build time. Drop the
bind-mounts. Drop the allow_failure. smoke:full-stack now gates the
release pipeline as designed.

Bonus security : cosign signing covers the policy bytes, not just the
binary. An operator verifying registry.gitlab.com/.../dns-filter:v0.5.4
is verifying the dnsmasq allowlist rules at the same time.

CI :
- ✅ Main pipeline green
- ✅ MR #21 merged
- ✅ Tag pipeline expected 32/32 hard-gate (no allow_failure)

Local test pass :
- ✅ 152 tests pass
- ✅ bash bin/test-full-stack.sh → 2/2 PASS without bind-mounts
- ✅ ruff / mypy / shellcheck clean

- Sidecar policy bytes are now part of the cosign-signed image,
  not external bind-mount files
- No more allow_failure shields in CI

- All pipeline jobs hard-gate releases (no allow_failure escape hatches)

- 35 ADRs (was 34 in v0.5.3)
- ADR-0035 NEW : DinD bind-mount → COPY-into-image solution

- JWT validation in /check
- OIDC discovery
- TTL cache for HTTPPrincipalProvider
- Bearer/mTLS auth on the IdP URL

- v0.6.0 — full OIDC integration on top of the v0.5 PrincipalProvider
  abstraction