1. Release tags are signed from 3.1.5 on. The public key is allowed_signers
   in this repository; see "Verify a Release" in the README.
2. New ACME_PACKAGED mode for distro-packaged installs: --install no longer
   copies the script into LE_WORKING_DIR, and --upgrade, --install-online and the
   auto-upgrade cron path defer to the system package manager
   (#7135).
3. Standalone mode listens on both IPv4 and IPv6 by default, and the port
   check now works on the BSDs, macOS and Haiku.
4. An explicit --days or --valid-to now outranks the ARI renewal window.
5. Order handling: poll the order this run created instead of the one the
   previous cert came from, wait for a not-ready order instead of failing the
   finalize, honor an HTTP-date Retry-After, retry a gateway error from the CA,
   and back off between retries.
6. alreadyRevoked is now treated as a successful revocation.
7. The conf file is never truncated when a saved value breaks the rewrite.
8. New DNS providers: Huawei Cloud (dns_hw), HestiaCP, DNSMint, Opteamax,
   Optidata Cloud, NexDNS, Realtox Media, myloc. Azure now supports Private DNS
   zones, netcup moved to the new REST API, and JD Cloud moved to the v2 API.
9. New deploy hooks: UniFi OS, JetKVM, Shelly (Gen3+), iKuai, and
   truenas_websocat for TrueNAS SCALE 25.10+.
10. dnsapi/dns_linode.sh (Linode API v3) was removed, use dns_linode_v4
    (#7054).
11. CI now also covers GNU Hurd, openEuler, HardenedBSD and OPNsense
    (31 platforms).
12. A lot of bug fixes.