iiiris v0.2.0 — HTJ2K decode + distroless default + IIIF compliance fixes
- **HTJ2K (JPEG 2000 Part 15) decode** via OpenJPEG ≥ 2.5.0. Accepts
both boxed `.jp2`/`.jph` files and raw J2K codestreams (the default
output of OpenJPH's `ojph_compress`). Encode remains classic Part 1.
- **Distroless container image is now the default release tag**:
`:v0.2.0` and `:latest` ship a ~46 MB distroless image (static-linked
libvips + OpenJPEG, no shell, no package manager). Debian-slim
fallback at `:v0.2.0-debian` for operators who need shell tooling.
- **IIIF compliance fixes from a dockerized iiif-validator run**:
- CORS `Access-Control-Allow-Origin: *` on every IIIF response.
- `Accept: application/ld+json` content negotiation on `info.json`.
- Slash-collapse middleware so `//foo`-style URLs route instead of
301-redirecting (which many IIIF clients don't follow).
- Validator coverage matrix: v3 14→3 failures (all upstream Python
bugs); v2 went from "silently ran zero tests" to 21 tests run
with 2 failures (same upstream bugs).
- **Default tag changes container image**: anyone pulling `:latest`
after this release gets the distroless image. If you need a shell
inside the container for debugging, pin to `:v0.2.0-debian`. See
[docs/deployment.md](docs/deployment.md) for the comparison table
and a rollback runbook.
- No config-file or env-var changes; existing configs continue to work.
- **CHANGELOG**: see [CHANGELOG.md](CHANGELOG.md) for the full list,
including the test-coverage push (54% → ~78% project-wide).