Conduit v0.18.0 release

Conduit v0.18.0 is the "trust your connectors, see your pipelines" release: a signed connector registry you can install from the CLI with signatures and SLSA provenance verified before anything runs, and a built-in UI served by conduit run for watching and operating your pipelines.

Key Highlights

• Signed connector registry. conduit connectors install <name> fetches a connector from the registry, verifies its signature and its SLSA provenance, and refuses anything it can't verify — no manual downloads, no unsigned binaries. Every connector is cosign-signed keyless (there are no private keys to leak) with SLSA Level 3 build provenance, pinned to the publisher's own release workflow, so you know a connector was built by who it claims, from the source it claims. Verification is fail-closed by design.
• Manage what's installed. conduit connectors uninstall, list --installed, audit (re-verify every installed connector against the current index), and bundle (package a connector for air-gapped installs) round out the lifecycle.
• Publish your own connector. Drop the connector-publish-action workflow into your connector repo and a tagged release is signed, provenance-attested, and proposed to the registry automatically.
• Built-in UI. conduit run now serves a UI at / — nothing extra to install. Watch the live record flow with per-stage before/after diffs, see pipeline topology, throughput, latency, and health at a glance, and start or stop pipelines from the browser. Authoring stays config-as-code; the UI is for observing and operating.

The registry launches with signed seed connectors for Postgres, Kafka, file, generator, and log — with S3 and more to follow.