Portal v0.28.0 — Upgrade-safe runners and honest fleet alarms

Runner upgrades stop breaking on their own history, and fleet alarms now say what is actually wrong.

Runner reliability

• The durable dispatch log migrates across format and location changes on boot instead of silently refusing every dispatch afterwards — the failure that hit hosts upgrading with v0.9 history. An unreadable log still refuses to start (a fresh empty log could double-run a redelivered mutation), but the error now names the file and the quarantine remedy.
• One broken installed pack degrades just that pack. The runner boots, serves every healthy pack, logs the failed directory on every start, and advertises the degradation — no more crash-loops from a single unparseable YAML file.
• install.sh verifies dispatch state with the staged binary before touching a running service, and aborts with options (or quarantines automatically under QUARANTINE_DISPATCH_LOG=1) instead of leaving a host crash-looping after an upgrade.
• emisar doctor now checks the dispatch log, reports degraded packs, and surfaces the last cloud rejection; emisar state check-dispatch-log gives scripts the same verdict.
• Outbound connections assert a TLS 1.2 floor, and the runner honors the portal's shutdown envelope instead of reconnect-churning.

Honest fleet diagnostics

• A runner that is not connected wears its connection story — never descriptor_mismatch or pack_untrusted alarms derived from a stale advertisement. Trust-vs-advertisement judgments wait for a live advertisement; executability gating is unchanged.
• Degraded packs surface as "pack X failed to load on runner Y" in MCP list_runners and as an amber notice with reasons and the reinstall remedy on the runner detail page.
• Denied runs return a bounded policy reason in MCP summaries, find_actions recalls natural multi-term queries better, and console-created runbooks are visible and executable over MCP.

Security

• Sign-in enforcement for Require SSO and Require MFA now covers every controller route.
• SCIM, audit-export, and runner-register endpoints are rate-limited.
• Account and user erasure (GDPR delete) is available as an operator-run release task.

Operations

• Direct alerts for database-down, zero-healthy-backend, and portal VM saturation conditions.
• docs/COMPATIBILITY.md now names on-host runner state (dispatch log, installed pack trees) as a compatibility surface with the migration rules that keep upgrades safe.

The runner binary ships alongside as runner-v0.13.0 with SLSA-3 build provenance and SHA256SUMS.