Major new features

Vault-signed SSH certificates for target authentication - #2734

SSH targets can now authenticate with a short-lived OpenSSH certificate signed per connection by a Vault / OpenBao secret backend.

SSH: new ssh.target_handshake_timeout config option for targets that accept the TCP connection but never complete the handshake @boenshao in #2641
Docker: the runtime image is now based on gcr.io/distroless/cc-debian12 (no shell, no package manager), which removes 60+ scanner CVEs from OS packages Warpgate never used. The warpgate user (UID 1000) and /data volume are unchanged by @mtthsbrd in #2705
fixed #2548 - RDP, VNC and web SSH now show users a fixed phrase when the target connection fails instead of the raw error in #2729
Closing a session (admin close, user deletion) now also aborts its pending approvals in c73ca3c
Admin UI: fuzzy search ranking in the target list in 5ea7dcc

VNC: target connect and handshake are now bounded by the same 10s / 30s deadlines as RDP in 8de78f5
Admin UI: the search box did nothing on the Admin roles and Target groups pages in 1c16a9f
API tokens: expiry picker used UTC instead of local time, treated the preset as milliseconds and showed the maximum in whole days only in 2a2c2c4

Full Changelog: v0.30.0-beta.1...v0.30.0-beta.2