chore: release v0.21.0

[mostafa]

Bump the workspace and all inter-crate version pins from 0.20.0 to 0.21.0, sync the workspace, fuzz, and wasm-smoke lockfiles, bump OCSF golden metadata.product.version pins and the rstix README install examples, and finalize the CHANGELOG by promoting the [Unreleased] section to [0.21.0] with a TL;DR summary, a compare link, and a release reference link.

Once merged, publishing the v0.21.0 GitHub Release triggers the crates.io, binary, and Docker workflows.

TL;DR

RSigma v0.21.0 is the "daemon throughput and STIX interop" release: the evaluation and daemon path gain witness-based candidate indexing, parallel parsing, multicore batching, and jemalloc on musl; rstix completes OASIS STIX 2.1 Interoperability use-case coverage with a self-certification CI gate; and detection engineering gains verified rule tuning, OCSF findings, and post-pipeline rule inspection.

• Daemon throughput: jemalloc for the musl allocator (Use jemalloc for better scaling performance with musl #412, thanks to @alltilla), parallel batch parsing and single-parse DLQ (Parse ordered daemon batches in parallel #415), default multicore batching (Use multicore batching by default #408), witness-based candidate indexing with pre-filter soundness fixes (Index rules by witness instead of exact values only #406), concurrent multi-batch detection (perf(daemon): concurrent detection for correlation-free engines #426, perf(daemon): deepen concurrent detection pipeline #428), short-circuit condition evaluation (perf(eval): short-circuit nonmatching condition details #427), ASCII case-insensitive Aho-Corasick and top-level key probes (perf(eval): ASCII case-insensitive candidate AC without fold copies #420, Probe candidate fields from event top-level keys #419), plus representative performance baselines and cross-architecture gates (Representative performance baseline and corpus witness audit #404, Add representative performance regression gates #409, ci(perf): gate Linux artifact scaling #429).
• rstix STIX interop: OASIS CSD01 golden harness through all 21 use cases (feat(rstix): OASIS STIX 2.1 Interop golden test harness #403, rstix: OASIS STIX 2.1 Interop normative fixtures and §2.3 suite checks #410, test(rstix): OASIS §3.1 Attack Pattern Producer and Consumer interop tests #413, test(rstix): OASIS §3.2 Campaign Sharing interop use-case tests #433, test(rstix): OASIS §3.3–§3.21 interop use-case tests #438), self-certification CI gate (test(rstix): STIX 2.1 interop self-certification CI gate #440), STIX 2.1 wire conformance (feat(rstix): close STIX 2.1 wire conformance gaps at parse and interop_strict #388), and TAXII collection ingest with DANE DNSSEC (feat(rstix): TAXII collection ingest into StixStore (taxii-store) #387, feat(rstix): DNSSEC-validate DANE TLSA/SRV for TAXII Client with dane_require_dnssec opt-out #381), thanks to @SecurityEnthusiast.
• Detection engineering: verified false-positive-driven rule tune (feat(rule): propose verified tuning filters #431), post-pipeline rule retrieval for embedders (Post-pipeline rule retrieval for embedders #437), OCSF Detection Finding output (feat(runtime): emit OCSF Detection Finding output per sink #397), incident bundle export (Incident bundle export #400), and list-valued add_condition (✨ feat: support list values in add_condition pipeline transformation #399, thanks to @frack113).
• Operator surfaces: per-sink output formats (refactor(runtime): add per-sink output format seam #396), complete --output-format coverage (fix(cli): honor --output-format across structured and artifact commands #389), and a documentation accuracy overhaul (docs: overhaul site accuracy against current CLI and crates #435).
• Dependencies: Dependabot batches across Rust, CI actions, and the VS Code extension (chore(deps): batch dependency updates (Jul 2026) #402, chore(deps): batch dependency updates (Aug 2026) #432, chore(deps): batch vscode security dependency updates #444).

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• RUSTDOCFLAGS='-D warnings' cargo doc --workspace --all-features --locked --no-deps
• cargo metadata --locked for the workspace, fuzz/, and ci/wasm-smoke/
• cargo test -p rsigma-runtime --test ocsf_golden --locked
• npm run docs:build and npm run docs:validate