Bind approvals to installation epoch

fix: preserve isolated workload identity across upgrades

fix: resume interrupted uninstallation

fix: recover interrupted lifecycle transactions

fix: restore supervisor after host reboot

fix: close Daybreak round-zero release gates

feat: add selected-workload offline boundary for 0.6.0

Prepare 0.5.0 release closure controls

Clear residual systemd unit state on uninstall

Correct quarantine cgroup uninstall preflight

Tolerate benign reset-failed uninstall result

Repair release correctness and operational safety gates

Add P0 supervisor self-protection

feat: add autonomous AI runtime containment

Repair Eggcracker fail-closed lifecycle for 0.1.1

Fix CI lint portability

Initial Lumi Nutcracker 0.1.0 release candidate