Release 0.28.0

[blaipr]

Bumps Cargo.toml to 0.28.0, dates the Unreleased section, adds its compare link. Tag follows the squash merge.

Minor: #220 changes what an endpoint renders, and #221 adds three config fields.

What is in it

#220 — publish a group the target does not have yet. A source declares what a group means; who is in it is often not its to know. Device42 settles membership on its next sync; Ansible's group_by settles it at play time, putting a host into an existing group of the same name and picking up the vars it finds there. The enricher skipped any group the target lacked, which for an inventory whose groups come from another system is most of them — 24 files of OS-specific variables reached nothing at all. The render side is the other half: a group with vars and no hosts was pruned as empty, so even a created group would have been discarded between the enricher writing it and the endpoint answering.

A group that did name hosts and lost them all to a filter is still pruned. The two empty groups are opposite cases and are now read as such.

#221 — select by group as well as by name. fields narrowed by variable name and nothing narrowed by group, which is the wrong axis: a tenancy's local accounts sit on its own group beside the login every play needs, under the same names on every tenancy's group. Adds groups, groups_excluded, fields_excluded — two axes, two directions, one rule: absent selects everything, present selects only what it names, an exclusion beats an inclusion.

Verified in the image

Built with podman, run against a real 1097-host inventory enriching a real 780-host Device42 replay, with the config we intend to ship:

oraclelinux_9 IS rendered, repositories_repos: 6 repos
  hosts key present: false        ← membership settled by group_by at play time
d42_inventory_source_iii   excluded
sssd_bind_password         excluded

--check-config passes inside the image against all five real deployment configs. 591 tests, seven new across the two PRs, each red before its change.