v0.16.0

This is a smaller release focused on reliability improvements, with a new WireGuard network inspection command and expanded Compose spec support for container capabilities and sysctls.

## ✨ Highlights

### WireGuard network inspection

PR: #161. Thanks to @jabr for the contribution ❤️

The new `uc wg show` command displays the WireGuard network configuration for a machine, including the interface details and all configured peers. This is useful for debugging network connectivity issues and understanding the mesh topology.

Use the `-m/--machine` flag to inspect the configuration of a specific machine in the cluster or the global `--connect user@host` flag to inspect the machine that has issues connecting to the cluster.

```bash
uc wg show
uc wg show -m machine-1
uc wg show --connect user@host
```

### Kernel capabilities and `sysctls` support

PRs: #238, #239. Thanks to @4ndv for the contribution ❤️

You can now use [`cap_add`](https://github.com/compose-spec/compose-spec/blob/main/spec.md#cap_add), [`cap_drop`](https://github.com/compose-spec/compose-spec/blob/main/spec.md#cap_drop), and [`sysctls`](https://github.com/compose-spec/compose-spec/blob/main/spec.md#sysctls) attribute in your Compose files to add or remove Linux capabilities and configure kernel parameters for service containers. This allows fine-grained control over container privileges and behaviour.

```yaml
services:
  app:
    image: myapp
    cap_drop:
      - ALL
    cap_add:
      - NET_ADMIN
    sysctls:
      net.core.somaxconn: 65535
      net.ipv4.tcp_syncookies: 1
```

### Improved cluster initialisation reliability

Machine initialisation and joining with `uc machine init/add` have been made more reliable that fixed WireGuard peer misconfiguration for machines joining the cluster:
- The daemon now waits for the initial Corrosion state sync and cluster components before serving gRPC requests
- `uc machine init` and `uc machine add` commands wait for cluster readiness
- gRPC auto-retries with exponential backoff for transient connection failures (up to ~8 seconds)

> [!NOTE]
> You have to upgrade both the local `uc` CLI and the Uncloud daemon on all your current machines to v0.16.0 to benefit from this improvement.

## Other improvements

- Added `--yes` flag to `uc machine init/add` to auto-confirm machine reset
- Added `ctx conn` alias for `uc ctx connection` command
- Reduced gRPC connection timeout to proxied machines from 20s to 10s
- Machine state file is now saved atomically to prevent corruption
- Config mounts are now creating non-existent parent directories (#233)

## Upgrade to 0.16.0

### Uncloud CLI locally

To upgrade the Uncloud CLI (`uc`) locally:

```bash
# Homebrew (macOS, Linux)
brew upgrade uncloud

# Install script (macOS, Linux)
curl -fsS https://get.uncloud.run/install.sh | sh
```

### Machine daemon

To upgrade the Uncloud daemon on your machines, run the following commands on each machine:

```bash
# AMD64
curl -fsSL -o uncloudd.tar.gz https://github.com/psviderski/uncloud/releases/download/v0.16.0/uncloudd_linux_amd64.tar.gz
# ARM64
# curl -fsSL -o uncloudd.tar.gz https://github.com/psviderski/uncloud/releases/download/v0.16.0/uncloudd_linux_arm64.tar.gz
tar -xf uncloudd.tar.gz
sudo install uncloudd /usr/local/bin/uncloudd
rm uncloudd uncloudd.tar.gz
sudo systemctl restart uncloud
```


## Changelog
* 878f96a4b7804644251e43c85f64f557b4e04ef8 Revert "build: Generate CLI docs in GHA"
* 9efaab2bebe97c7c5b5e7285ec0e2a295d0e4eba build: Generate CLI docs in GHA
* 5e0d4d0f05a7a7b4f562fd7896baf05005835c0c build: Generate CLI docs in GHA (#236)
* 33a3683196f44900697f4b96e7a58c02ab37b8e4 chore: Regenerate CLI docs
* 85a2615db1d5ee6c28eba404176043a452fb89e4 chore: add 'ctx conn' alias for 'ctx connection' command
* 5acf557675816f0084a33f28b6734deeb4f0fd80 chore: add --yes flag to 'uc machine init/add' to auto-confirm machine reset
* 777615bc5651571374eacd8d88a627cb5ad358e2 chore: add TODO to remove extra checks after upgrading clusters to perform store sync
* 4d97c30a9c813b4d89657771390f3c76d346d25e chore: enable gRPC auto retries for transient Unavailable failures up to ~8s
* 76affeb6b2a9220adf41403d1f9790932580ca7d chore: minor formatting for 'wg show' command, enrich Unimplemented error with >=0.16 requirement
* fc847093d29c121ab48f2401cb720971806d8c85 chore: new InspectMachine gRPC method that to return store DB version (lamport time)
* 436671457d65c3a9db7fd6716b6a0daf278cb2ec chore: pass current store DB version when adding new machine to cluster
* f86e63c851b4f05e2199f5a9c07661acd0abf654 chore: reduce the default gRPC connection timeout to proxied machines 20->10s
* bac34ebd0cdd279b71aa08b6e1905da032f2a227 chore: save machine state file atomically
* 5308c876516c89802b18f4e485be9284824d276e chore: update 'uc machine init/add' to wait for cluster readiness, confirm caddy deployment on added machine
* 9bd5ffcd2d83d2ec1f0a686954371eb2450f0913 chore: update ucind cluster to wait for initial store sync and cluster readiness
* f6cf73190f64a3782b1e80e9aecbad546da6fe94 chore: wait for FailedPrecondition in addition to Unavailable for backward compatibility
* 8d8acd54107748dc809a32a580dc6a3d08558e9a chore: wait for the initial store sync and cluster components before serving cluster gRPC requests
* a945291371ad906104b657dadb66e9960f662e7e feat: Add `uc wg show` command to inspect a machine's uncloud wireguard network (#161)
* 6c2f85d38a14ff6485a8b7bd3f7d1082d70dcab1 feat: add support for `cap_add` and `cap_drop` compose keys (#238)
* 06c3fba96e2a07ef2567e51bdb10c45c893363d3 feat: add support for `sysctls` compose key (#239)
* 2c34ba7effc545b35c1a2295b92e09cecec57d48 fix(configs): Create non-existent parent directories automatically (#233)
* 9a1d2e0d461393a59f9cfcf2d6e045d2a5cd5a5c fix: Equals and Clone for configs (#235)
* b2322e1c49e35c5c6d74ccfbe03c781a16239e82 fix: WireGuard peers misconfiguration on joined machine by waiting for the initial store sync
* aa71ab022030a561bcbc7d450a321d76461d7ff6 fix: e2e caddy test after changing the config header
* 4be1ea3506442968797b365deed2a56b951d7371 fix: machine name for failed machines in 'uc ps'
* d2a7af744defb74ddae2755cc1fa65805edb80e6 fix: uncloud daemon crash when listing partially replicated container records
* 65e9cdd44448e7ca27d8059b372833e9843b4e6a refactor: use WaitGroup.Go to replace wg.Add(1)/go/wg.Done() boilerplate (#222)