[fas89]

Release 0.21.0

Cuts 0.21.0 from the unreleased changes:

• Added: engine: flink (schema 0.7.6 preview, feat: engine: flink (0.7.6 preview) runs outside forge-cli; Flink SQL stays off the inline-SQL paths #731). Overlays merge builds, exposes and consumes by identity from fluidVersion 0.7.6, and older contracts warn when a positional patch lands on another entry (feat(loader): overlays patch builds, exposes and consumes by identity (schema 0.7.6) #732).
• Fixed: a local expose lands the last build that produced a table (feat: engine: flink (0.7.6 preview) runs outside forge-cli; Flink SQL stays off the inline-SQL paths #731). Also from fix: untrusted-input guards for the seed guard, contractId resolver and YAML loader #725: the --seed-from seed guard, malformed contractIds in ODPS imports, fluid odps import <dir>, fluid generate artifacts and fluid odcs validate --report.
• Security: YAML guard caps on alias expansion and nesting depth, and a committed .env can no longer redirect the FLUID LLM key (fix: untrusted-input guards for the seed guard, contractId resolver and YAML loader #725).

Several entries change behaviour; the Upgrade notes section lists them.

CHANGELOG.md only. The [Unreleased] compare link moves to v0.21.0...HEAD, and this adds the [0.20.0] link, which was missing. After merge, tag v0.21.0 on the merge commit once ci.yml is green on it; release.yml publishes to PyPI.

Documentation

• Docs PR linked:
• No docs needed — CHANGELOG-only release commit; the features' docs are docs: engine: flink, and overlays that merge by identity from 0.7.6 (forge-cli #731, #732) forge_docs#155.
• Docs TODO