v1.6.1-rc.6

Full Changelog: v1.7.0-rc.5...v1.6.1-rc.6

[1.6.1-rc.6] — 2026-08-28

Maturity-policy overrides no longer get wiped by drydock's own self-update. updatePolicyRetentionCache — the stash that lets a recreated container inherit its predecessor's maturity mode, min-age, skip list, and snooze — lived only in a bare in-memory Map, so the SIGTERM-driven restart that is drydock's own self-update (recreate action, SIGTERM, new process) wiped the stash before the replacement container could consume it, silently dropping controller-set update policy. The cache now writes through to a durable LokiJS-backed store and rehydrates from it at startup before the first container is inserted, the same treatment the sibling lifecycle cache already had. Backported from the v1.7 line, where the reporter's version could not reach it. (#565)

Note: this is a maintenance cut, built from dev/v1.6 at df8cac1975f72198b7b9c68b9ffa08799c069af3, not from main.

The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.