docs: align published Server 521 release entry points

COMPATIBILITY.md

@@ -1,5 +1,18 @@
 # Compatibility Contract
 
+## Server v1.6.521 published
+
+The [official release](https://github.com/PastureStack/server/releases/tag/v1.6.521)
+is the immutable image
+`ghcr.io/pasturestack/server:v1.6.521@sha256:bd368b3ac58c7b161442906241aa7ef2a41360a164cb3ca181d0b84742fb2194`.
+It packages Web Console `1.6.181` and Orchestration Engine `v0.183.337`.
+The image has 22 layers; publication identifies producer
+`d478d917f989903dafc6bb834b7f9017126a68bd` and protected-main merge
+`d0d1b417833c25e4a6b765e27e3a52f450d7c0e1`.
+See the [release note](docs/releases/server-1.6.521.md) for audit identity scope.
+Install examples use the published numeric tag; immutable identities stay in
+release records. This is not C-03, C-05 live or full-matrix acceptance.
+
 ## Server v1.6.518 published
 
 Immutable image:

README.md

@@ -38,7 +38,8 @@ stack and resource selectors close before dependent loading or verification.
 Failed Key edits use a consistent public Key ID in audit records. Per-Key audit
 also reads historical numeric-ID records within the same ownership and environment
 authorization checks; existing records are not rewritten.
-See the [release note](docs/releases/server-1.6.521.md) for exact
+See the [published v1.6.521 release](https://github.com/PastureStack/server/releases/tag/v1.6.521)
+and [release note](docs/releases/server-1.6.521.md) for exact
 component identities and verification boundaries. A version or packaged feature
 does not establish that every resource/role/hardware combination has been tested.
 

docs/README.md

@@ -7,6 +7,13 @@ runtime gates have passed.
 
 ## Release notes
 
+- [Server v1.6.521](releases/server-1.6.521.md) — officially published with
+  Engine `0.183.337` and Web Console `1.6.181`; canonical API Key audit identifiers
+  and historical numeric-ID reads retain ownership and environment checks.
+  [Official release](https://github.com/PastureStack/server/releases/tag/v1.6.521).
+  Component and scoped evidence do not establish C-03, C-05 live or full-matrix
+  acceptance; exact identities and limits remain in the versioned release note.
+
 - [Server v1.6.518](releases/server-1.6.518.md) — officially published with Catalog v0.3.13 / Network Plugin Manager v0.8.22 CNI configuration migration fixes, Web Console 1.6.180 / audit broker full-retained-time query and export, and the official FreeType security fix; artifact readback and scoped isolated-QA deployment/read-only checks verified. Known limits remain in the release note.
 
 - [Server v1.6.517](releases/server-1.6.517.md) — officially published with Web Console 1.6.179; isolated start/restart, browser login and focused API acceptance passed. Known limits remain in the versioned release note.

docs/performance/README.md

@@ -11,7 +11,7 @@ profile; measure the real workload before increasing it further.
 ```yaml
 services:
   pasturestack-server:
-    image: ghcr.io/pasturestack/server:v1.6.518
+    image: ghcr.io/pasturestack/server:v1.6.521
     restart: unless-stopped
     ports:
       - "8080:8080"

docs/releases/server-1.6.521.md

@@ -2,6 +2,14 @@
 
 Packages Engine `v0.183.337` and unchanged Web Console `1.6.181`.
 
+## Published identity
+
+The [official v1.6.521 release](https://github.com/PastureStack/server/releases/tag/v1.6.521)
+identifies the immutable image
+`ghcr.io/pasturestack/server:v1.6.521@sha256:bd368b3ac58c7b161442906241aa7ef2a41360a164cb3ca181d0b84742fb2194`,
+with 22 layers, from producer `d478d917f989903dafc6bb834b7f9017126a68bd`.
+This publication identity does not establish full functional-matrix acceptance.
+
 ## API Key audit identity
 
 Rejected Key edits after request validation could be recorded under an internal