v0.4.2

v0.4.2 — Offline config apply / config rollback

Phase 3, seventh slice. The pre-apply safety workflow is now complete
offline: validate → explain → diff → plan → apply → rollback.

Added

• config apply: fail-closed gate (loads, validates and resolves exactly
  like run — exit 1 leaves the state untouched), pushes the previous
  current.toml to history/ (capped at 32, oldest pruned) and installs
  the candidate via atomic rename. Re-applying identical bytes is a no-op
  report. State lives in ./.eqproxy (EQPROXY_STATE_DIR overrides it).
• config rollback: re-gates the newest backup (relative cert paths
  resolve against the apply-time directory recorded in its header) and
  pops it into current — one rollback per apply to walk back; going
  forward again is a fresh apply.

Changed

• Dependencies: equivalent 1.0.2 → 1.0.3 (transitive, semver-compatible).

Scope honesty

This release is not declared production ready (Phase 9 gate pending):
TCP + HTTP/1.1 only. apply/rollback manage versioned files offline;
hot config reload under traffic stays pending (S-CFG-01). 128 tests green
(fmt, Clippy -D warnings, full workspace suite, per-artifact release E2E
with live proxied traffic, Veyra Proof audit).

Verify

shasum -c SHA256SUMS.txt
./eqproxy-darwin-arm64 --version  # eqproxy 0.4.2