ee v0.14.5: Linux compatibility and storage recovery

ee 0.14.5 improves Linux binary compatibility, storage recovery, and runtime resource use.

• GNU/Linux binaries target glibc 2.28 on x86-64 and ARM64. The release build now checks the ELF binary's actual symbol requirements before packaging, preventing the build host from silently raising the minimum supported glibc version (#38).
• SQLite busy lock-wait timeouts are retried during concurrent storage operations and CASS imports. Import transactions now retain the database writer lock through commit or rollback and roll back unfinished writes during unwinding. Actual deadlines and cancellation remain terminal. Doctor reports the versions of the dependencies linked into this release.
• Windows storage now honors the dedicated database worker's existing capability to perform small I/O directly, with the same 64 KiB limit as Unix. Larger transfers and ordinary async callers retain offload. Cancellation and tracked-write outcomes are preserved.
• The pinned FrankenSQLite update includes legacy V2 certificate-log recovery (#27). A controlled legacy-record fixture preserved its stored canary through migration checks, another write, and a subsequent search; the reporter's original database was unavailable for reproduction.
• CLI runtimes use bounded, lazy blocking pools. Initialization and migration checkpoint their writes, and doctor warns about excessive WAL growth. Doctor's thread creation dropped substantially in the measured fixture. Generated SessionStart hooks still withhold the orientation payload when it exceeds their token ceiling; #35 remains open for the complete ambient-context experience.
• Daemons warm their resident search stack at startup and expose warm.posture. Requests received during warm-up fall back with an explanation. Warm-RPC overhead can still exceed the default two-second client deadline on some hosts; #37 remains open, and generated hooks do not yet route orient/recall through the daemon (#39).
• Workspace backups preserve more recovery state, including authorization keys through encrypted key backups, memory revisions, relationship metadata, tombstones, authenticated audit history, and learned procedural evidence.
• Explicit stored recipes participate in task recommendations with scope and evidence explanations. An OpenAI-compatible remote embedding backend is available as an explicit opt-in; local operation remains the default.

The pinned stack uses Asupersync 0.4.10, FrankenSQLite 0.3.18, SQLModel 0.4.3, Frankensearch 0.5.0, FrankenNetworkX 0.2.1, and nightly-2026-08-31. The rustls-pemfile maintenance exception remains required by the pinned TLS dependency graph (#22).

Validation: source 214f1ed passes Linux all-target checking, Clippy with -D warnings, formatting, and the forbidden-dependency audit. On 1c9043e, three focused CASS tests, 15 manifest tests, and four public-identifier checks passed. Default-profile Unix library coverage completed across two batches: 9,496 passed and three existing ignores, using 2 MiB stacks and four test threads. The first full invocation timed out after two hours; the unfinished cases passed in a second batch. This does not resolve the original 128-thread report in #29. The subsequent source changes pin Windows-only FrankenSQLite backports for compilation and bounded I/O dispatch. Nine backup, daemon recovery, and writer integration tests also passed on the earlier 612f48f test binaries; one pre-existing bridge test remained ignored. These are self-reviewed results, not an independent verification.

Final GNU qualification: the x86-64 binary passed on Debian 10 (glibc 2.28) and Ubuntu 24.04, passed 36 basic/selected advanced CLI checks, and preserved every write in a six-process contention test. Its real-model search returned 50 reranked results without degradation on a 505-memory fixture. Doctor reported ok with 21 clone calls in 4.4 seconds on a one-memory fixture. The controlled legacy V2 certificate fixture also passed. The ARM64 GNU binary passed the glibc 2.28 symbol gate and completed init → remember → search → pack in an emulated ARM Debian 10 container.

The final static musl binary completed the same memory workflow in Debian 10. The macOS ARM64 binary completed it natively on Apple Silicon and passed eight boundary migration checks. Windows passed all three new storage regressions and the complete memory workflow natively. Initialization took 34.6 seconds after the preceding candidate exceeded the unchanged 180-second limit; host load varied, so this is not a controlled speedup benchmark. Windows was cross-compiled on Linux using cargo-xwin 0.23.1; its release build retains existing platform warnings.

The macOS x86-64 binary completed the memory workflow through Rosetta on Apple Silicon. All six release targets were built from commit 214f1ed009481a5e99824d2e16350aebd934a5f9; the tested binaries are the ones included in the release archives.

The Linux installer passed checksum verification, self-test, and the installed memory workflow in a private destination. Cleanup was excluded from that probe.

Like v0.14.4, this release provides SHA-256 checksums and a build manifest without Sigstore signatures or SLSA attestations; --require-provenance is not supported by these assets.