v0.5.0 - Real VM lifecycle wiring

What changed

This is the first release where tinybridge-vmhost actually drives a real VM
through Apple's Virtualization.framework end-to-end, instead of a hardcoded
"status": "running". Full details in the commit history on this tag; short
version:

• Fixed the Swift Virtualization.framework bridge, which did not actually
  compile as checked in (a stale prebuilt dylib had been committed from a
  different machine). It builds cleanly now (swift build -c release).
• Wired the real VM lifecycle end-to-end: tinybridge-vmhost's
  VmController now constructs and drives a real tinybridge_vz::VirtualMachine
  for start/stop/force_stop/status, propagating real FFI errors instead of a
  fabricated "running" status. The daemon's VmManager now issues a real
  vmhost.start RPC (previously it only pinged status after a fixed sleep).
• Found and fixed a real platform bug: Virtualization.framework dispatches
  callbacks onto the process's main GCD queue; a plain #[tokio::main]
  process silently hangs forever on every VM call. Fixed by running the async
  server on a background thread and dedicating the main thread to
  dispatch_main().
• Verified end-to-end: built and ad-hoc-codesigned the real
  tinybridge-vmhost binary (with the com.apple.security.virtualization
  entitlement), ran it, and drove it over its real Unix-socket JSON-RPC
  protocol against a real downloaded ARM64 Linux kernel. Observed
  Stopped -> Running (with a detected NAT guest IP) -> Stopped.
• Security hardening: real SHA-256 checksum verification for snapshot
  images and the rootfs-build script's downloads (both previously
  unverified), standardized safe-by-default (NAT) network mode, VM control
  socket permissions hardened to 0600, VirtioFS host-path scoping
  implemented and tested ahead of its FFI wiring.
• Honest relabeling: Windows/Linux platform adapters (previously
  committed as "Phase 6.1/6.2/6.3 Implementation") are now explicitly
  documented as unimplemented scaffolding - they only ever mutated an
  in-memory HashMap and are not wired into anything.
• CI: re-enabled the Swift build and brought tinybridge-vz and
  tinybridge-daemon into the tested set (previously skipped).
• README/SECURITY.md rewritten to reflect all of the above accurately -
  including fixing a stated MIT license that contradicted the actual
  Proprietary LICENSE file, and removing references to a Homebrew tap and
  package-manager installs that don't exist.

What's NOT yet verified

Full guest OS boot to a login/SSH prompt. That requires a complete, real root
filesystem image, which this repository does not bundle or auto-download
today. The verification above used a real kernel and a placeholder disk
image, sufficient to prove the hypervisor genuinely boots and runs guest
code, not a full guest OS.

Distribution

There is no Homebrew tap, package manager entry, or crates.io publish for
this project (crates.io wouldn't be a good fit anyway - this is a Proprietary-
licensed application workspace with a macOS-only Swift/Virtualization.framework
dependency baked into several crates, not a set of general-purpose reusable
libraries). This GitHub Release is the actual distribution channel: a real,
built-from-this-tag macOS (Apple Silicon / arm64) binary tarball is attached
below, with SHA256SUMS included in the archive.

Build target note: the attached binary was built and tested on
Apple Silicon (arm64). An Intel (x86_64) build was not produced in this pass
(this development environment is Apple Silicon only) - build from source with
cargo build --release --target x86_64-apple-darwin if you need one.