[calvinbrewer]

Why

The v2.2.5 release run failed in Verify release metadata:

Cargo.toml workspace version (2.2.4) does not match release tag v2.2.5.

The tag was cut on release/2.2 (5f99d7e) before a prepare-release PR bumped the version.
The build and publish jobs were skipped, so no 2.2.5 images were published.

What

• Bump [workspace.package] version from 2.2.4 to 2.2.5 and sync Cargo.lock (cargo update --workspace).
• Promote the [Unreleased] CHANGELOG entries to ## [2.2.5] - 2026-10-30 and update the compare links.

Same shape as the v2.2.4 prepare commit (a239ebc1).
The workflow's version/changelog check passes locally against this commit.

After merge

mise run release only runs from main, so re-cut the release manually:

gh release delete v2.2.5 --yes --repo cipherstash/proxy
git push origin :refs/tags/v2.2.5 && git tag -d v2.2.5
git fetch origin && git tag v2.2.5 origin/release/2.2 && git push origin v2.2.5
gh release create v2.2.5 --repo cipherstash/proxy --target release/2.2 --generate-notes --notes-start-tag v2.2.4 --latest=false

--latest=false keeps v3.0.1 as the latest release.