What
The SSE (server-sent events, a way of streaming data over HTTP) transport used for network connections gained the ability to hold a "worker attestation policy sink" and, if one is set, to add a worker_capabilities=attestation-floor/1 marker to its connection URL and parse a new x-ccr-attestation-policy response header. That header can specify a mode (off, observe, or enforce) and an acceptance level such as VERIFIED_BY_GATE. Nothing in this build actually sets the sink, so none of this runs yet.
Why
This is groundwork for a future worker-attestation feature (a way to verify properties of the machine handling a request) that isn't wired up or active in this build.