Add zero-dependency hosted receipt verifier (#50)

Release Lumi Eggcracker 1.0.10

Repair descendant liveness qualification

Repair escaped launch attribution

Bind approvals to installation epoch

allow upgrade from 1.0.6 candidate

repair collected launch recovery across epochs

repair incident-store discovery availability

fix: restore hosted proof identity validation

Repair terminal history pruning after boundary cleanup

Serialize owned containment with autonomous detection

Repair autonomous boundary cleanup

Repair approval admission race and boundary recovery

Allow upgrades from the 1.0.0 candidate

Repair approval revocation enforcement

Add one-command hosted containment proof (#28)

fix: bind approvals to resource limits

fix: complete upgrades after transitional health proof

fix: preserve isolated workload identity across upgrades

fix: resume interrupted uninstallation

fix: recover installed runtime directory ownership

fix: recover interrupted lifecycle transactions

fix: reject noncanonical release archive paths

fix: preserve exact zipapp interpreter prefix

fix: reject ambiguous release archive framing

fix: authenticate public release assets

fix: repair public 1.0 operator paths

fix: restore supervisor after host reboot

test: wait for autonomous lockdown persistence

fix: close Daybreak round-zero release gates

test: reset autonomous smoke lockdown between phases

test: make autonomous smoke approvals unique

test: align autonomous AI smoke profile

test: wait for terminal parent-child reconciliation

test: reset lockdown between offline repetitions

test: make installer campaign version agnostic

fix: reset autonomous matrix lockdown between phases

fix: pass runtime library to content matrix

fix: clear smoke lockdown before chained validation

fix: use disk-backed root-controlled smoke staging

fix: stage smoke fixtures under root-controlled runtime

fix: make real AI smoke lockdown-aware

release: freeze 1.0.0 candidate

feat: add bounded post-containment local lockdown

fix: validate upgrade socket ownership and group

fix: include upgrader in release verification

feat: add transactional 0.8.1 upgrade and recovery

fix: read nested execution policy creation result

test: permit hostile client execution in native matrix

fix: align installer with 0.8