fix: reject noncanonical release archive paths

fix: preserve exact zipapp interpreter prefix

fix: reject ambiguous release archive framing

fix: authenticate public release assets

fix: include upgrader in release verification

test: add native offline boundary integration matrix

feat: add selected-workload offline boundary for 0.6.0

Launch first-kill social campaign surface

Fix extracted release self-verification

Freeze the 0.5.0 engineering preview contract

Complete native P0 and fault-injection qualification

Add native P0 qualification and release identity hardening

Prepare 0.5.0 release closure controls

Include native matrix in public qualification bundle

Make bundled qualification fixtures self-contained

Require a qualified PyTorch bridge-ATen pair

Bound deep inspection cost and publish overhead benchmark

Repair release correctness and operational safety gates

Include Safetensors smoke scripts in release verification

Add aggressive Safetensors PyTorch containment profile

Add P0 supervisor self-protection

feat: add local self-validation command

test: add content qualification matrices

fix: record content qualification timing

feat: add name-independent GGUF recognition

feat: add autonomous AI runtime containment

release: add reproducible real AI smoke for 0.1.2

Repair Eggcracker fail-closed lifecycle for 0.1.1

Fix CI lint portability

Initial Lumi Nutcracker 0.1.0 release candidate