foreman v0.2.8 — vendor concurrency + hard mode

Closes the last two v0.2.7.5 "not-usable-yet" gaps: vendor concurrency is verified and uncapped, and hard mode (containerized untrusted workers) is shipped and proven on real Docker.

Vendor concurrency (T5b) — GREEN

Live, user-authorized shared-account destructive matrix: grok GREEN at N=2 and N=3, codex GREEN at N=2. Pueue caps raised to the proven-green N — grok 1→3, codex 1→2 — and grok promoted to a verified default-eligible implementer. Doctrine reconciled across README / SKILL / lanes / orchestration-hardening / CLAUDE; results in docs/research/vendor-concurrency-results.md.

Hard mode — worker-run + pr-open shipped

Two profiles, selected by hard_mode.profile (default launcher-only):

• launcher-only (no Docker): worker runs in the run's worktree under foreman-launch supervision; clean-slate env (no host secrets); heartbeats mirrored to the event log; host-side evidence + host-side commit — the worker never commits.
• container: a clean git archive file-copy work dir bind-mounted into a hardened devcontainer on an egress-capable bridge; a root entrypoint applies a default-deny egress firewall (IPv4 + IPv6, two-host allowlist) then gosu-drops to an unprivileged worker that cannot flush it; --read-only rootfs + tmpfs for /tmp,/run,/home/worker; no docker.sock, no host secrets; delete-aware sync-back.
• pr-open: gate precondition → host-side HTTPS push with a fine-grained, single-repo PAT via GIT_ASKPASS (token never in argv) → gh pr create --draft; gh pr ready stays a separate human step.

Proven live on WSL Docker 29.6.2: image builds; firewall default-deny v4+v6; worker unprivileged; $HOME writable under --read-only; allowlisted host reachable, non-allowlisted host blocked.

Quality

The plan survived 3 Opus audit rounds (6 → 3 → 0 blocking) before implementation. Each of 3 implementation lanes was Sonnet-implemented → Opus-audited → architect-verified (container verified live on Docker) → fixes applied.

Honest residuals

• The container live bats test skips where Docker isn't on the (Git-Bash) PATH — proven manually on WSL; a full in-container worker E2E needs vendor auth inside the container (API-key mode).
• codex concurrency proven at N=2 (cap 2); N=3 unrun.
• grok must be on PATH for grok lanes (installed at /c/root/.local, not on the default inherited PATH — a Setup-stage concern). The lane-run grok Use-path readiness gate runs a network-flaky timeout 10 grok models probe, so the grok-lane / vendor-isolation unit tests are coupled to live grok readiness — a robustness follow-up (stub the probe in those unit tests; have foreman-setup persist grok on PATH).

Release lineage: First Light v0.1.0 → Nightwatch v0.2.0 → Beacon v0.2.5 → v0.2.7.5 → v0.2.8.