docs: v0.5.0 release notes

[fslongjin]

Summary

Adds the v0.5.0 changelog and updates the changelog index, mirroring the v0.4.0 entry layout. The body is written in the same style as the previous release notes: features grouped by audience, enhancements, bug fixes, documentation, and engineering improvements.

What's in this PR

• docs/changelog/v0.5.0.md (new) — English release notes
• docs/zh/changelog/v0.5.0.md (new) — Chinese release notes
• docs/changelog/index.md — adds v0.5.0 row
• docs/zh/changelog/index.md — adds v0.5.0 row
• docs/guide/digital-assistant.md — fixes code-block language tag (env -> bash)
• docs/zh/guide/digital-assistant.md — same fix in Chinese

Release scope

85 commits from 22 contributors since v0.4.0. Key themes:

• Lifecycle: e2b-compatible lifecycle kwarg with auto-pause/auto-resume, kill-on-timeout as the new default, set_timeout / refresh APIs, stable end_at
• Network: per-sandbox traffic access tokens, CubeEgress fail-closed bootstrap, CubeVS sandbox-to-host-service access, network hardening guide
• Image and template: pure-Go native rootfs export, TUI template management with pull progress, real envd version probing, fix for image-layer uid/gid squashing
• Deployment: --mode upgrade with three-way .env merge, external MySQL/Redis, Terraform-based Tencent Cloud cluster deployment, configurable TKE replicas
• Control plane: snapshot runtime binding rework fixing MySQL 1213 deadlocks under concurrent rollback, cross-replica node metadata sync, template-deletion resource cleanup paths

Notes

This PR contains documentation only. The code changes corresponding to the listed features already landed on master since v0.4.0; the changelog is being published as a single release-note batch.

The two digital-assistant.md edits correct the fenced code-block language tag from env to bash so it renders correctly; no content change.

[cubesandboxbot]

PR #708 Review: v0.5.0 Release Notes (Documentation Only)

Verdict: Looks good overall. One minor inconsistency to review.

Noteworthy Findings

1. PR #558 reference discrepancy in Chinese pull-progress section (Medium)

• docs/zh/changelog/v0.5.0.md line 76 references #558 alongside #580 for the "拉取进度追踪" bullet
• docs/changelog/v0.5.0.md line 76 references only #580 for the same "Pull progress tracking" bullet

The CN version reads:

拉取进度追踪（#558，#580）：模板镜像拉取进度持久化到 Redis…

While the EN version reads:

Pull progress tracking (#580): Template image pull progress persists in Redis…

#558 (Pure-Go Native Rootfs Export) is a separate feature and the EN version does not associate it with pull progress tracking. Recommend removing #558 from the CN entry to match the EN version — or adding it to the EN version if there is a deliberate cross-reference to the image engine abstraction from #558.

Summary of Other Review Dimensions

• Code quality: Markdown formatting is consistent with v0.4.0; front-matter, section structure, and emoji headings all match the existing convention.
• Documentation accuracy: All 50+ PR numbers are consistent between EN and CN versions; the env → bash code-block fixes in both digital-assistant.md files are correct.
• Performance: No issues. Performance claims (rootfs export measurements, cache sizing, etc.) are attributed to specific PRs with reasonable baselines.
• Security: Security-relevant entries (traffic tokens, CubeEgress fail-closed, MSI-X hardening, auth callback, encrypted config removal) are described accurately.
• Test coverage: No test-coverage concerns in these documentation-only changes.

Minor Notes (Not Blocking)

• The token enforcement section in the changelog (line 43) references "403" while the status-code convergence section (line 171) maps token errors to "404". The upgrade notes (line 277) do clarify the transition, but a brief note about the layering (#639 internally signals 403, #653 remaps to 404 at HTTP response) would eliminate a moment of confusion.