Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.32.27 to 1.32.28.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.27...config/v1.32.28)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

… liveness

onctl -p fc ls kept reporting microVMs as "running" indefinitely after
their firecracker process died out-of-band — most notably a host reboot,
which every firecracker VMM dies to but leaves metadata.json's
last-written status untouched. Deploy() had the same blind spot: it
treated a stale "running" record as proof the microVM was already up
and silently no-op'd instead of recreating it.

List/Deploy/GetByName now reconcile the persisted status against
Process.IsRunning + Process.Owns (the same liveness check Destroy
already used to guard against PID reuse), self-healing a stale record
to a new "stopped" status on disk. Deploy() redeploys over a stopped
record instead of returning it unchanged, and SSHInto now fails fast
with a clear message instead of hanging against a dead socket.

onctl create checks provider.List() for a same-named VM before calling
Deploy, but List() includes fc records reconciled to "stopped" (dead
process, e.g. after a host reboot). That made the check abort with "VM
exists" instead of ever reaching Deploy's stale-record recreate path,
defeating the reconciliation added in the previous commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RuNxaYWJi7HTNLUAZjPC1y

fix(fc): reconcile stale running/paused status against actual process liveness

#955)

PR #954's reconciliation persisted a dead fc microVM's status as
"stopped" — but cmd/list.go's isPausedStatus() already treats the
literal string "stopped" as the cross-provider paused/resumable
convention (AWS "stopped", GCP "TERMINATED", Azure "deallocated") and
folds it into onctl ls's PAUSED section. That collision made a
reboot-killed microVM (no restart-from-disk, must be destroyed and
recreated) render as merely "paused" (implying it can be resumed),
which is exactly what this fix was supposed to stop lying about.

Renames fcStatusStopped to fcStatusDead ("dead") throughout pkg/cloud
and the cmd/create.go duplicate-name check, and adds
TestIsPausedStatus in cmd/list_test.go to lock in the distinction.

Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.287.0 to 0.287.1.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.287.0...v0.287.1)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.287.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) from 1.311.0 to 1.313.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ec2/v1.311.0...service/ec2/v1.313.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2
  dependency-version: 1.313.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

#958)

* fix(release): sign checksums with explicit GPG key in isolated keyring

The self-hosted release runner is persistent (not ephemeral), so the
shared ~/.gnupg default keyring can end up in a state where gpg can't
resolve an unambiguous default signing key, failing with
"no default secret key: No public key". Import the key into a
job-scoped GNUPGHOME and have goreleaser sign with the imported key's
fingerprint explicitly instead of relying on gpg's default-key guess.

* fix(ci): write proper KEY=VALUE to GITHUB_ENV for GNUPGHOME

echo "$GNUPGHOME" >> "$GITHUB_ENV" wrote just the value with no key,
which GitHub's env-file parser rejects ("Invalid format"). Test run
against v0.1.30 caught this before it could hit a real release.

* ci(release): disable actions/setup-go cache on the self-hosted runner

GOCACHE/GOMODCACHE already persist on this runner's disk between
runs since it's a long-lived machine, not ephemeral. Uploading/
downloading GitHub's remote Actions cache on top of that just adds
several minutes of upload time for a multi-GB cache with no benefit.