Repair descendant liveness qualification

Repair escaped launch attribution

Bind approvals to installation epoch

allow upgrade from 1.0.6 candidate

repair incident-store discovery availability

Repair terminal history pruning after boundary cleanup

Serialize owned containment with autonomous detection

Repair autonomous boundary cleanup

Repair approval admission race and boundary recovery

Allow upgrades from the 1.0.0 candidate

fix: complete upgrades after transitional health proof

fix: preserve isolated workload identity across upgrades

fix: recover interrupted lifecycle transactions

fix: restore supervisor after host reboot

release: freeze 1.0.0 candidate

feat: add bounded post-containment local lockdown

fix: validate upgrade socket ownership and group

feat: add transactional 0.8.1 upgrade and recovery