v0.4.4

v0.4.4 — doctor pre-flight diagnostics

Phase 3, eighth slice. With this release every planned CLI command is
implemented except config import (Phase 8): validate, explain,
diff, plan, apply, rollback, doctor.

Added

• eqproxy doctor [--config <file>]: pre-flight environment diagnostics.
  With a config it gates exactly like run, then reports one
  ok:/warn:/err: line per check: a momentary TCP bind per listener
  (proves the port is free and permitted), the TLS state per listener,
  and the FD budget from SPEC §7.3 / T07 (2 FDs per connection across all
  maxconn plus one per listener with 10 % margin, against the soft
  NOFILE limit — a short budget warns, never fails). Verdict line last,
  exit 0 unless the gate fails or any check errors. With no --config,
  environment only. Backend reachability is deliberately not probed.
• New dependency: rlimit 0.10 (safe NOFILE reads; unsafe stays
  forbidden workspace-wide).

Scope honesty

Not declared production ready (Phase 9 gate pending): TCP + HTTP/1.1
only; apply/rollback manage versioned files offline, hot config
reload under traffic stays pending (S-CFG-01). 136 tests green (fmt,
Clippy -D warnings, full workspace suite, per-artifact release E2E with
live proxied traffic, Veyra Proof audit).

Verify

shasum -c SHA256SUMS.txt
./eqproxy-darwin-arm64 --version  # eqproxy 0.4.4