## What's Changed
* fix(charts): set seccompProfile so the app pods meet restricted PSA
* fix(scripts): create the kafka2pg pipeline Secrets by default
* ci: release the wirefilter FFI image on its own tag train
* fix(single-node): ban-ledger-api at 1 replica, drop redundant registry flags
* rules-validator: record the commit the waf scheme was actually emitted from
* Harden the relay's auth boundary, and make the render prove it is installable
* fix(single-node): stop hardcoding the k3s storage class
* fix(charts): set imagePullSecrets for the mirrored valkey and kafka2pg images
* chore(infra): take synapse chart 0.4.1