[captjt]

Release prep for v0.0.20, following CONTRIBUTING.md.

• CHANGELOG: the Unreleased entries move to ## [0.0.20] - 2026-10-28. Since v0.0.19 that is integrity-blob: move the Azure backend to object_store (RUSTSEC-2026-0275) #55: the blob-azure backend moves from the legacy Azure SDK to object_store, clearing RUSTSEC-2026-0275 (MIC-84). Unreleased stays at the top, empty. The comparison links are advanced: [Unreleased] compares v0.0.20...main, and [0.0.20] compares v0.0.19...v0.0.20.
• Version: [workspace.package].version moves from 0.0.19 to 0.0.20. Cargo.lock changes only the 12 workspace crates' versions. The FFI ABI version (0.5.0) is a separate contract and is unchanged; integrity-blob: move the Azure backend to object_store (RUSTSEC-2026-0275) #55 didn't change the ABI.

These pass on Rust 1.94.1:

• ./scripts/check-changelog.sh v0.0.20
• just fmt-check, just lint, just test (90 passed)
• cargo check --locked -p integrity-ffi --features blob-all,signer-all

After merging: tag the merge commit on main and push the tag. That starts the native FFI release workflow, which checks for the ## [0.0.20] heading and then builds and publishes the artifacts.

git tag v0.0.20 <merge-commit>
git push origin v0.0.20

Then Guardian's services/integrity-service bumps its integrity tag to v0.0.20, and cargo deny check advisories should no longer report RUSTSEC-2026-0275 (MIC-84 step 3).

🤖 Generated with Claude Code