Maintenance and hardening release: Go 1.26.3 toolchain, kcp stack to v0.7.1 / sdk v0.31.2, a new fuzz-testing suite, and a round of CI supply-chain hardening. The bulk of
the changes are routine dependency updates.

🚀 Features

• Enable workspace resolver to find nested workspaces by @Perseus985 in #54

🧪 Testing

• Add webhook + fieldpath fuzz tests with scheduled CI by @BergCyrill in #68

🔒 Security & supply-chain hardening

• Bump golang.org/x/net to v0.55.0 to fix OSV advisories (GO-2026-5024..5030) by @BergCyrill in #91
• Pin GitHub Actions to digests and add 1-day Renovate quarantine by @BergCyrill in #62
• Dockerfile digest pinning by @Perseus985 in #71
• Harden context interpolation in publish workflows by @BergCyrill in #67
• Add permissions declaration for Docker image build workflow by @BergCyrill in #63

📝 Documentation

• Update README and development documentation by @BergCyrill in #64

⬆️ Dependency updates

Go modules

• kcp-dev/multicluster-provider → v0.7.1 by @renovate[bot] in #50,
  #75
• kcp-dev/multicluster-provider/client → v0.7.1 by @renovate[bot] in #51,
  #76
• kcp-dev/sdk → v0.31.2 by @renovate[bot] in #81
• onsi/ginkgo/v2 → v2.29.0 by @renovate[bot] in #72,
  #73
• onsi/gomega → v1.41.0 by @renovate[bot] in #74
• apigen → v0.31.2 by @renovate[bot] in #79

GitHub Actions

• github/codeql-action → v4.36.0 by @renovate[bot] in #59,
  #69
• google/osv-scanner-action → v2.3.8 by @renovate[bot] in #65
• golangci/golangci-lint-action → v9.2.1 by @renovate[bot] in #80
• docker/login-action → v4.2.0 by @renovate[bot] in #84
• docker/build-push-action → v7.2.0 by @renovate[bot] in #83
• docker/metadata-action → v6.1.0 by @renovate[bot] in #85
• docker/setup-buildx-action → v4.1.0 by @renovate[bot] in #86
• docker/setup-qemu-action → v4.1.0 by @renovate[bot] in #88

Toolchain & dev tooling

• Go toolchain → 1.26.3 (version sync, go-overlay/dev-kit, builder image digest) by @renovate[bot] & @BergCyrill in
  #60, #87,
  #78
• opendefensecloud/dev-kit → v1.0.8 by @renovate[bot] in #82
• osv-scanner (module) → v2.3.8 by @renovate[bot] in #61

Full Changelog: v0.3.0...v0.4.0