Merge origin/main into feat/ppe

Two conflicts, both resolved by keeping each side:

server/src/watcher.rs: this branch writes `*content_hash = new_hash` after a
successful reload (the hot-reload fix), main added a reload-success metric on
the same line. Both belong, state update first.

Cargo.lock: regenerated from main's side rather than hand-merged, then
re-resolved. The engine stays on the pinned revision.

Verified that praxis-proxy#912's route-scoped identity fix survived, since it touches the
policy filter this branch rewrote onto the engine: `route_ext` and the
`MetaExtension` stamping are present and its tests came across. 1851 filter
tests pass with `policy-engine` on, up from 1831.

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>

Author: araujof

.github/workflows/codeql.yaml

@@ -34,7 +34,7 @@ jobs:
         uses: praxis-proxy/conventions/.github/actions/setup-rust@dc77dbd3a55ce96e8e31a3c8d36cea4952617dd3 # v0.1.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
 
@@ -43,6 +43,6 @@ jobs:
         run: cargo build --workspace
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/tests.yaml

@@ -72,3 +72,49 @@ jobs:
 
       - name: Unit tests
         run: make test-unit
+
+  # ----------------------------------------------------------------------------
+  # Non-default feature verification (per crate, parallel)
+  # ----------------------------------------------------------------------------
+
+  experimental-features:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        crate:
+          - praxis-proxy-core
+          - praxis-proxy-filter
+          - praxis-proxy-tls
+          - praxis-proxy
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Rust
+        uses: praxis-proxy/conventions/.github/actions/setup-rust@dc77dbd3a55ce96e8e31a3c8d36cea4952617dd3 # v0.1.0
+
+      - name: Cache cargo-hack
+        id: cache-hack
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cargo/bin/cargo-hack
+          key: cargo-hack-0.6.45-${{ runner.os }}
+
+      - name: Install cargo-hack
+        if: steps.cache-hack.outputs.cache-hit != 'true'
+        run: cargo install cargo-hack@0.6.45 --locked
+
+      - name: Clippy non-default features
+        run: >
+          cargo hack clippy --each-feature
+          --exclude-no-default-features --exclude-features default
+          -p ${{ matrix.crate }}
+          -- -D warnings
+
+      - name: Test non-default features
+        run: >
+          cargo hack test --each-feature
+          --exclude-no-default-features --exclude-features default
+          -p ${{ matrix.crate }}